PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4655 bdthemes CVE debrief

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG Image Widget in versions up to and including 8.4.2. This is due to insufficient input sanitization and output escaping on SVG content fetched from remote URLs in the render_svg() function. Authenticated attackers with Contributor-level access and above may inject arbitrary JavaScript in SVG files that will execute whenever a user accesses a page containing the malicious widget. This vulnerability has a CVSS score of 6.4 and is considered Medium severity. WordPress users and administrators should review and update their installations to mitigate this vulnerability.

Vendor
bdthemes
Product
Element Pack Addons for Elementor
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-25
Advisory published
2026-04-08
Advisory updated
2026-07-25

Who should care

Authenticated attackers with Contributor-level access and above may inject arbitrary JavaScript in SVG files that will execute whenever a user accesses a page containing the malicious widget. WordPress users and administrators should review and update their installations to mitigate this vulnerability. Security teams should prioritize patching and monitor for suspicious activity.

Technical summary

The render_svg() function fetches SVG content using wp_safe_remote_get() and then directly echoes it to the page without any sanitization, only applying a preg_replace() to add attributes to the SVG tag which does not remove malicious event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary JavaScript in SVG files. The vulnerability exists in versions up to and including 8.4.2 of the Element Pack Addons for Elementor plugin.

Defensive priority

Medium priority given the CVSS score of 6.4 and the potential for authenticated attackers to inject malicious JavaScript.

Recommended defensive actions

  • Update Element Pack Addons for Elementor plugin to a version beyond 8.4.2.
  • Restrict Contributor-level access and above to trusted users.
  • Monitor for suspicious SVG file uploads and modifications.
  • Implement additional security measures such as Content Security Policy (CSP) to mitigate XSS attacks.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-04-08T08:16:24.407Z and was last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Deferred. Evidence is limited to public sources and may not reflect the full scope or impact of this vulnerability. Defenders should verify affected deployments and review official advisories for specific guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T08:16:24.407Z and has not been modified since then. The NVD entry is currently Deferred.