Element Pack - Premium Addon for Elementor WordPress Plugin v9.9.1
## 9.9.1 [24th August 2026]
### Fixed
- Table widget: fatal error fixed on PHP 8.4+ when the CSV Delimiter field was left empty or set to a dynamic tag that resolved to nothing, `str_getcsv()` now always receives a valid single-character separator (falling back to sniffing the CSV itself when none is set)
- Table widget: a UTF-8 byte order mark at the start of a CSV file no longer leaks into the first header cell
## 9.9.0 [23rd August 2026]
### Fixed
- Iconnav, Circle Menu, Price Table, Marker, Helpdesk, Icon Mobile Menu, Logo Grid and Logo Carousel widgets: Stored XSS vulnerability fixed in the tooltip text of each, the same entity encoded payload that affected Image Stack
- Tooltip HTML is now filtered through an allow list of formatting tags, so headings, bold, italic, links and line breaks keep working while scripts, iframes, event handler attributes and `javascript:` links are removed
- Tooltip extension: the shared HTML sanitizer now parses markup with the browser's HTML parser instead of a regular expression, so an unterminated tag such as `<img src=x onerror=...` can no longer slip through
- CSS issue fixed in Scroll Box extension
- Image Stack widget: Stored XSS vulnerability fixed, where an entity encoded payload in an item's Tooltip Text survived tag stripping and was executed when the tooltip rendered ( Thanks to Wordfence )