PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2024-1055 | WordPress Plugin Vulnerability Report

Plugin Name: PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)

Key Information:

  • Software Type: Plugin
  • Software Slug: powerpack-lite-for-elementor
  • Software Status: Active
  • Software Author: ideaboxcreations
  • Software Downloads: 2,129,545
  • Active Installs: 100,000
  • Last Updated: February 13, 2024
  • Patched Versions: 2.7.15
  • Affected Versions: <= 2.7.14

Vulnerability Details:

  • Name: PowerPack Addons for Elementor <= 2.7.14
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1055
  • CVSS Score: 5.4
  • Publicly Published: February 6, 2024
  • Researcher: Webbernaut
  • Description: The PowerPack Addons for Elementor plugin, a versatile tool for enhancing Elementor with additional widgets, extensions, and templates, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 2.7.14. This issue arises from insufficient input sanitization and output escaping on user-supplied URL values within the plugin's buttons, enabling attackers with at least contributor-level access to embed malicious scripts into web pages.


The PowerPack Addons for Elementor plugin, widely used by WordPress users to expand the capabilities of the Elementor page builder, has been identified with a critical security vulnerability in versions up to 2.7.14. This Stored Cross-Site Scripting vulnerability, effectively addressed in the patch released as version 2.7.15, underscores the importance of vigilance in plugin maintenance to ensure website security.

Detailed Overview:

Discovered by the security researcher Webbernaut, this vulnerability highlights the potential risks associated with insufficient data validation practices in plugin development. The ability for authenticated users to inject arbitrary scripts poses significant security threats, including unauthorized access to sensitive information and manipulation of web page content. The swift response with a patch in version 2.7.15 demonstrates the critical nature of the vulnerability and the necessity for immediate updates.

Advice for Users:

  • Immediate Action: Users are urged to update the PowerPack Addons for Elementor plugin to the latest patched version, 2.7.15, to mitigate the vulnerability and secure their websites.
  • Check for Signs of Vulnerability: Website administrators should monitor for unusual site behavior or unauthorized content changes as indicators of potential exploitation.
  • Alternate Plugins: While the current patched version is secure, users may explore alternative plugins for Elementor enhancements as part of a diversified security strategy.
  • Stay Updated: Consistently updating all WordPress plugins and themes is essential in safeguarding against known vulnerabilities and maintaining a secure online presence.


The resolution of the Stored Cross-Site Scripting vulnerability in the PowerPack Addons for Elementor plugin serves as a crucial reminder of the ongoing need for diligence in the digital security landscape. WordPress site owners, particularly those with limited time for site maintenance, are encouraged to prioritize plugin updates and adhere to security best practices. This incident highlights the importance of proactive security measures and the collective responsibility of the WordPress community in maintaining a secure and trustworthy platform for all users.


In the digital tapestry of WordPress, plugins like "PowerPack Addons for Elementor" are integral threads that enhance the web-building experience, offering a plethora of widgets, extensions, and templates. However, the discovery of CVE-2024-1055—a Stored Cross-Site Scripting (XSS) vulnerability within this widely utilized plugin—serves as a poignant reminder of the fragile equilibrium between functionality and cybersecurity. This vulnerability, affecting versions up to 2.7.14, underscores the imperative of diligent website maintenance and the constant vigilance required to navigate the ever-evolving landscape of digital threats.

Plugin Overview:

"PowerPack Addons for Elementor" is renowned for its capability to augment the Elementor page builder, providing users with an expansive array of creative tools. With over 2 million downloads and a user base exceeding 100,000 active installations, its impact on the WordPress community is undeniable. Developed by ideaboxcreations, this plugin has become a cornerstone for enhancing website aesthetics and functionality.

Vulnerability Details:

CVE-2024-1055 exposes a critical Stored Cross-Site Scripting vulnerability within the plugin, specifically through the inadequate sanitization and escaping of user-supplied URL values in the plugin's button settings. This flaw permits authenticated individuals with contributor-level access or higher to embed malicious scripts, which are subsequently executed by any user visiting the affected page. Publicly disclosed by researcher Webbernaut on February 6, 2024, this issue was promptly addressed in the patch released as version 2.7.15.

Potential Risks:

The vulnerability poses significant security risks, including unauthorized access to sensitive information, manipulation of site content, and potential compromise of user data. For small business owners who rely on their WordPress sites for e-commerce, customer engagement, or content delivery, such vulnerabilities can have far-reaching consequences, eroding customer trust and potentially leading to financial and reputational damage.

Remediation Steps:

In response to CVE-2024-1055, the developers of "PowerPack Addons for Elementor" released version 2.7.15, effectively patching the vulnerability. Site owners are urged to update to this latest version immediately to mitigate associated risks. Additionally, conducting regular site audits, monitoring for unusual activity, and considering alternative plugins can further bolster site security.

Historical Context:

This is not the first instance of vulnerability within the "PowerPack Addons for Elementor" plugin, with three previous issues reported since April 13, 2021. This history accentuates the ongoing challenge of ensuring plugin security and the importance of regular updates and security assessments.

Concluding Thoughts:

The swift resolution of CVE-2024-1055 by the plugin's developers highlights the critical role of timely updates in safeguarding WordPress installations. For small business owners, this incident underscores the necessity of proactive security measures and the importance of staying informed about potential vulnerabilities within their digital ecosystem. In the fast-paced digital arena, the security of WordPress plugins is not merely a technical concern but a fundamental aspect of maintaining a secure, reliable, and trustworthy online presence for businesses and their customers.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2024-1055 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment