PowerPack Addons for Elementor Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget – CVE-2024-1411 | WordPress Plugin Vulnerability Report

Plugin Name:PowerPack Addons for Elementor

Key Information:

  • Software Type: Plugin
  • Software Slug: powerpack-lite-for-elementor
  • Software Status: Active
  • Software Author: ideaboxcreations
  • Software Downloads: 2,157,052
  • Active Installs: 100,000
  • Last Updated: February 16, 2024
  • Patched Versions: 2.7.16
  • Affected Versions: <= 2.7.15

Vulnerability Details:

  • Name: PowerPack Addons for Elementor <= 2.7.15
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1411
  • CVSS Score: 6.4
  • Publicly Published: February 15, 2024
  • Researcher: wesley (wcraft)
  • Description: The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the settings of the Twitter Buttons Widget in all versions up to, and including, 2.7.15. This vulnerability arises due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses an injected page.


The PowerPack Addons for Elementor for WordPress has a vulnerability in versions up to and including 2.7.15 that enables authenticated attackers with contributor-level permissions or higher to inject malicious scripts through the Twitter Buttons Widget settings. This vulnerability has been patched in version 2.7.16.

Detailed Overview:

This vulnerability was identified by the researcher wesley (wcraft), highlighting a significant security flaw within the PowerPack Addons for Elementor plugin. The specific location of the vulnerability lies in the settings of the Twitter Buttons Widget, where insufficient input sanitization and output escaping mechanisms are in place. This oversight allows attackers to embed harmful scripts into web pages, posing risks such as data theft, unauthorized access, and other security breaches to unsuspecting users. To address this issue, the plugin developers have released a patched version, 2.7.16, which eliminates the vulnerability and reinforces the security of the plugin.

Advice for Users:

Immediate Action: Users of the PowerPack Addons for Elementor plugin are strongly encouraged to update to the patched version, 2.7.16, to protect their sites against this vulnerability. Check for Signs of Vulnerability: Website administrators should review their site for unusual content or behavior, especially in pages that utilize the Twitter Buttons Widget, to identify potential compromises. Alternate Plugins: While a patch is available, considering alternative plugins offering similar functionality may serve as an additional precautionary measure. Stay Updated: It is crucial to keep all WordPress plugins up to date to safeguard against vulnerabilities and ensure the security and functionality of your website.


The swift action taken by the developers of PowerPack Addons for Elementor to release a patch for this vulnerability underscores the critical nature of maintaining up-to-date software on your WordPress site. To secure your installation against potential threats, users are advised to upgrade to version 2.7.16 or later of the plugin.


In today's digital landscape, the security of your WordPress website is paramount, serving as the cornerstone of your online presence and credibility. A recent discovery that underscores this ongoing challenge involves a critical vulnerability in the PowerPack Addons for Elementor plugin, identified as CVE-2024-1411. This vulnerability serves as a potent reminder of the ever-present need to maintain vigilance and keep all aspects of your website up to date to safeguard against potential threats.

PowerPack Addons for Elementor: A Snapshot

The PowerPack Addons for Elementor enriches WordPress sites with advanced capabilities through its collection of free widgets, extensions, and templates. Developed by ideaboxcreations, this popular plugin boasts over 100,000 active installations and has been downloaded more than 2 million times. Despite its widespread use and regular updates, vulnerabilities can still emerge, as evidenced by the recent security issue.

The Vulnerability at a Glance

CVE-2024-1411 is a vulnerability that stems from insufficient input sanitization and output escaping within the plugin's Twitter Buttons Widget settings, affecting versions up to and including 2.7.15. Authenticated users with contributor-level access or higher can exploit this flaw to execute stored cross-site scripting (XSS) attacks, injecting malicious scripts that run whenever an infected page is accessed. Discovered by researcher Wesley (wcraft), this vulnerability poses significant risks, including unauthorized data access, website defacement, and compromise of user security.

Risks and Potential Impacts

The implications of this vulnerability are far-reaching, potentially leading to data theft, unauthorized access to sensitive information, and a tarnished reputation due to compromised website integrity. For small business owners, such breaches can result in significant financial losses and erode customer trust, which is often difficult to rebuild.

Remediation and Proactive Measures

To mitigate this vulnerability, users are urged to update the PowerPack Addons for Elementor plugin to the patched version, 2.7.16, immediately. Additionally, conducting regular audits of website content and behavior, especially in areas utilizing the affected widget, can help identify any signs of compromise. Considering alternative plugins with similar functionality may also serve as a precautionary measure, albeit a temporary one. The most effective strategy, however, is to ensure that all WordPress plugins and themes are routinely updated to their latest versions.

Historical Context

This is not the plugin's first encounter with security vulnerabilities; there have been four previous instances since April 13, 2021. Each of these vulnerabilities has been addressed in subsequent updates, highlighting the developer's commitment to security and the importance of keeping your website components current.

The Imperative of Vigilance

For small business owners juggling myriad responsibilities, staying abreast of every security update can seem daunting. However, the digital integrity of your business hinges on such diligence. Leveraging tools that automate updates and conducting regular security audits can significantly reduce the risk of vulnerabilities. Engaging with a professional service for website maintenance and security can also provide peace of mind, allowing you to focus on your core business operations while ensuring your online presence remains secure and trustworthy.

In summary, the discovery of CVE-2024-1411 within the PowerPack Addons for Elementor plugin serves as a critical reminder of the dynamic nature of web security. By adopting a proactive approach to website maintenance, employing best practices for security, and remaining vigilant about updates, small business owners can protect their online assets and sustain the trust and confidence of their users.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

PowerPack Addons for Elementor Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget – CVE-2024-1411 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment