ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title in Blog Posts Widget
- ID
- WPSEC-2026-0232
- Plugin
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite)
- Affected
- all versions before 4.0.7
- Remediation
- Update to 4.0.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title rendered by the Blog Posts widget in all versions up to, and including, 4.0.6. This is due to the post title being printed into the featured image alt attribute with the_title() without attribute escaping. This makes it possible for authenticated attackers with author-level access and above to publish a post with a featured image and a crafted title that breaks out of the attribute and injects arbitrary web scripts, which execute whenever a user accesses a page where a Blog Posts widget lists that post.
References
- https://wpsec.com/vuln/WPSEC-2026-0232/
- https://plugins.svn.wordpress.org/elementskit-lite/tags/4.0.7/
- https://wordpress.org/plugins/elementskit-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS