News Kit Elementor Addons CVE-2026-11390

Exploitation requires an authenticated WordPress account with contributor-level permissions or higher on the target site - fully unauthenticated attackers cannot trigger the vulnerability. The attacker must be capable of intercepting and modifying outbound HTTP requests (e.g., using Burp Suite or OWASP ZAP) to alter the tag-name parameter in the elementor_ajax AJAX POST request, bypassing the client-side SELECT restriction that is the only enforcement point. At least one page on the target site must include the Site Logo Title widget or the Single Author Box widget from the News Kit Addons For Elementor plugin. Impact is further limited to users (including administrators) who subsequently browse pages containing the injected payload - the server itself is not directly compromised. The requirement for prior contributor authentication is the primary limiting factor: sites that restrict contributor role assignment to vetted, trusted authors face substantially lower realistic risk than open-registration or heavily multi-authored platforms.

The NVD CVSS 6.4 (Medium) vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N reflects network-based exploitability requiring only contributor-level authentication and no elevated complexity, with scope change to victim browsers. One noteworthy tension exists: the description explicitly states that exploitation requires intercepting and modifying the AJAX request to bypass client-side restrictions, which implies a proxy-tool step - a factor some assessors would score AC:H, though NVD's AC:L appears defensible since the technique is routine and requires no race condition or specialized environment. The UI:N metric is debatable for stored XSS: the NVD position treats browsing a page as non-interactive, whereas victim page-visit is a meaningful prerequisite that warrants UI:R in an independent assessment. No EPSS data was provided in the intelligence; without it, exploitation probability cannot be quantified precisely. The absence from CISA KEV and lack of identified POC suggest no confirmed widespread exploitation. Real-world priority is elevated above average PR:L XSS findings because news and media WordPress sites routinely grant contributor access to multiple authors, increasing the pool of potential attackers compared to tightly managed sites.

An attacker with a contributor account on a WordPress site running News Kit Addons For Elementor 1.4.6 opens the Elementor editor, places a Site Logo Title widget on a draft page, and saves the page while routing traffic through Burp Suite. In the intercepted elementor_ajax POST request, the attacker replaces the widget's heading-tag parameter value with a crafted script payload. The modified request is forwarded to the server, the payload is persisted to the WordPress database, and the page is published. When a site administrator later visits the page to review content, the injected script executes in their browser session, allowing the attacker to exfiltrate authentication cookies or perform authenticated actions at the admin level. No public proof-of-concept has been identified at time of analysis.