Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Element Pack Elementor Addons 5.10.1版本及之前版本存在跨站脚本漏洞，该漏洞源于通过自定义图库小部件image_title参数进行存储型跨站脚本。
WordPress plugin Element Pack Elementor Addons 跨站脚本漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://patchstack.com/database/Wordpress/Plugin/bdthemes-element-pack-lite/vulnerability/wordpress-element-pack-elementor-addons-plugin-8-3-13-cross-site-request-forgery-csrf-vulnerability
https://cve.imfht.com/detail/CVE-2025-5944
https://wp-firewall.com/zh_cn/hardening-elementor-addons-against-cross-site-scripting-published-on-2026-04-08-cve-2026-4655/
https://www.knowsafe.com/ti/info/0/987348
https://www.cnvd.org.cn/flaw/show/CNVD-2025-18919
https://wpscan.com/plugin/bdthemes-element-pack-lite/
https://avd.aliyun.com/detail?id=AVD-2024-5555
https://managed-wp.com/zh_hk/blogs/hardening-elementor-addons-against-cross-site-scripting-cve20264655-2026-04-08/
https://zone.ci/aliyun/ali_nvd/366975.html
https://www.sentinelone.com/vulnerability-database/cve-2026-4655/
https://wordpress.org/plugins/bdthemes-element-pack-lite/
https://github.com/advisories/GHSA-7gg4-p3gv-m4fh
https://www.rapid7.com/db/vulnerabilities/bdthemes-element-pack-lite-plugin-cve-2025-8100/
https://research.cleantalk.org/cve-2024-10980/