EUVD-2026-43611
GHSA-q988-g5jr-8jjr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects mandatory contributor authentication; UI:R corrects the provided vector - stored XSS requires a victim to visit the injected page; S:C captures cross-browser session impact unchanged.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an attacker to intercept and modify the elementor_ajax AJAX save request in order to bypass the client-side SELECT control restrictions and submit arbitrary tag-name values.
AnalysisAI
Stored Cross-Site Scripting in the News Kit Addons For Elementor WordPress plugin (versions ≤1.4.6) permits authenticated contributors to persistently inject arbitrary JavaScript into pages via the Site Logo Title and Single Author Box widgets by manipulating the elementor_ajax AJAX save request to bypass client-side tag-name restrictions. Every user who subsequently visits an injected page executes the attacker's script in their browser, enabling session hijacking, credential theft, or admin-level actions on their behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in version 1.4.7.
Technical ContextAI
The affected product is the News Kit Addons For Elementor plugin by Blazethemes (CPE: cpe:2.3:a:blazethemes:news_kit_addons_for_elementor), an Elementor page-builder extension targeting news and media WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting): two specific widget source files - site-logo-title.php (lines 49, 50, 58) and single-author-box.php (line 831) - accept a tag-name parameter from the Elementor AJAX save endpoint without applying server-side sanitization or output escaping. The plugin's only restriction on allowed HTML tag names is a client-side SELECT control in the Elementor editor UI, which is trivially defeated by intercepting the underlying elementor_ajax POST request. Because the tag-name value is rendered directly into page HTML, arbitrary tags including script blocks are persisted to the database and served to all subsequent visitors, crossing the scope boundary into victim browser sessions (S:C).
RemediationAI
Upgrade the News Kit Addons For Elementor plugin to version 1.4.7 or later; this is the vendor-released patch confirmed by the WordPress plugin repository changeset between revisions 3580563 and 3586039 (https://plugins.trac.wordpress.org/changeset?reponame=&new=3586039%40news-kit-elementor-addons%2Ftrunk&old=3580563%40news-kit-elementor-addons%2Ftrunk) and by the presence of updated source files under the 1.4.7 tag in trac. If patching cannot be applied immediately, the most effective compensating control is to revoke or restrict contributor-level access for untrusted or external accounts on the site, which eliminates the attack surface entirely - though this will disrupt editorial workflows on multi-author sites. As an additional layer, deploying a Web Application Firewall rule to intercept elementor_ajax POST requests and block values in the tag-name parameter that are not in an allowlist of safe HTML tag names (e.g., div, span, h1-h6, p) can reduce exploitation likelihood; note that overly broad WAF rules may break legitimate Elementor page editing and require careful tuning. Disabling the Site Logo Title and Single Author Box widgets within the plugin settings, if that option is exposed, would also remove the vulnerable endpoints without requiring full plugin deactivation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today