# CVE-2026-125708: BdThemes Element Pack Elementor Addons stored XSS

Source: https://junglewise.ai/threats/cve-2026-125708-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-125708 · Severity: medium · CVSS 6.5 · Published 2026-11-11

Element Pack is a WordPress plugin that extends the Elementor page builder with additional design components. A stored cross-site scripting vulnerability allows authenticated attackers with contributor or developer privileges to inject malicious scripts that will execute for all visitors to the affected website, potentially stealing user data or hijacking accounts.

Technologies: [BdThemes Element Pack Elementor Addons](https://junglewise.ai/threats/technologies/element-pack-elementor-addons). Vendors: [BdThemes](https://junglewise.ai/threats/vendors/bdthemes).

## Quick answers

**Is CVE-2026-125708 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125708 being exploited in the wild.

**How severe is CVE-2026-125708?** Medium severity, with a CVSS score of 6.5, published 11 November 2026.

**Which products and versions are affected?** BdThemes Element Pack Elementor Addons through 10.0.4.

**Is there a fix for CVE-2026-125708?** Yes: fixed in 10.0.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125708 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-125708?** Check whether you run BdThemes Element Pack Elementor Addons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 10.0.5

## Technical details

This is a stored cross-site scripting vulnerability in BdThemes Element Pack Elementor Addons affecting versions 10.0.4 and earlier. An authenticated attacker with contributor or developer permissions can inject malicious JavaScript that persists in the plugin's data and executes in the browsers of site visitors. The vulnerability requires user interaction to set up the malicious payload but affects all subsequent visitors without interaction.

## Affected products

- BdThemes Element Pack Elementor Addons through 10.0.4

## Timeline

- 2026-11-09: disclosed: Reported by nh4tvd
- 2026-11-11: advisory: Published by Patchstack

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack-lite/vulnerability/wordpress-element-pack-elementor-addons-plugin-10-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/bdthemes-element-pack-lite/vulnerability/wordpress-element-pack-elementor-addons-plugin-10-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [BdThemes Element Pack Elementor Addons stored XSS](https://junglewise.ai/threats/cve-2026-124752-improper-neutralization-of-input-during-web-page-generation)
- [BdThemes Element Pack Elementor Addons stored cross-site scripting](https://junglewise.ai/threats/cve-2026-119501-improper-neutralization-of-input-during-web-page-generation)
- [BdThemes Element Pack Elementor Addons stored cross-site scripting](https://junglewise.ai/threats/cve-2026-108478-improper-neutralization-of-input-during-web-page-generation)
- [BdThemes Element Pack Elementor Addons contributor XSS](https://junglewise.ai/threats/cve-2026-66574-bdthemes-element-pack-elementor-addons-contributor-xss)
- [Element Pack Elementor Addons stored XSS via uikit data attributes](https://junglewise.ai/threats/cve-2026-14817-element-pack-elementor-addons-stored-xss-via-uikit-data)