News Kit Addons CVE-2026-120524

Requires an authenticated account with subscriber-level access or above - exploitable in practice mainly on sites permitting self-registration. Two specific product conditions enable it: (1) an operator-precedence bug in handle_scripts() causes the admin bundle and its inlined nekit-admin-nonce to be enqueued on every admin screen reachable by subscribers (e.g. /wp-admin/profile.php), handing low-privileged users the nonce needed for the request; and (2) sanitize_text_field() is applied to the raw JSON string before json_decode(), so angle brackets encoded as \u003c/\u003e survive sanitization and are restored to literal '<'/'>', permitting overwrite of _elementor_data on any post. Limiting factors: authentication is mandatory (not unauthenticated), the plugin (News Kit Addons For Elementor, versions ≤1.4.8) must be installed and active, and realistic impact depends on another user - typically an admin or visitor - later viewing the injected page for the stored script to fire.

This is a genuine but mid-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) indicates a network-reachable, low-complexity stored XSS requiring only subscriber-level authentication (PR:L) with no victim interaction to inject, and a changed scope (S:C) reflecting that injected script executes in the browser context of any user who later views the poisoned page. The vuln.today Decision label is 'this_month' - a scheduled-remediation signal, not act_now or emergency. It is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation; the references are Wordfence's analysis and WordPress trac source lines documenting the flaw, not a verified weaponized exploit. The low privilege barrier is meaningful on sites that allow open registration (common for WooCommerce/membership sites), where any subscriber becomes an attacker - this is the main factor that elevates it above a trivial issue. Impact is capped at C:L/I:L (no availability impact), consistent with script injection rather than full compromise. Missing data to note explicitly: no EPSS, no KEV, and no vendor-confirmed fixed version in the provided input (only a trac changeset reference suggesting a patch exists).

On a WordPress site with open user registration, an attacker registers a subscriber account and submits a request to the plugin's handler with a crafted 'formData' parameter whose angle brackets are encoded as \u003c/\u003e so they survive sanitize_text_field() before json_decode(), overwriting _elementor_data on a target post with a malicious script. When an administrator or other visitor subsequently opens that page, the script executes in their browser. No public, verified working exploit code was identified at time of analysis, though Wordfence has published a technical write-up pinpointing the vulnerable code paths.