ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Builder Control Values
- ID
- WPSEC-2026-0233
- Plugin
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite)
- Affected
- all versions before 4.0.7
- Remediation
- Update to 4.0.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the control values of custom widgets created with the Widget Builder in all versions up to, and including, 4.0.6. This is due to the widget template compiler printing a control value without escaping whenever its placeholder shared a text node or attribute value with other text, sat in an unquoted attribute, or sat inside a script or style element, and escaping event-handler attribute values only with esc_attr(). This makes it possible for authenticated attackers with contributor-level access and above, who can edit content with Elementor, to inject arbitrary web scripts through the settings of such a custom widget that execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0233/
- https://plugins.svn.wordpress.org/elementskit-lite/tags/4.0.7/
- https://wordpress.org/plugins/elementskit-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS