EUVD-2026-51434
GHSA-5fj7-xcmr-5r75
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Scope changed to C because multisite subsite admin can compromise Super Admin session across trust boundaries; PR:H and UI:R retained as admin credentials and victim page load are both required.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfiltered_html, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.
AnalysisAI
Stored XSS in ElementsKit Elementor Addons (WordPress plugin before 3.10.01) allows administrative users to inject malicious JavaScript into megamenu menu-item settings, which is rendered unsanitized to all page visitors. The most critical exploitation path targets WordPress multisite networks: a subsite Administrator - a role WordPress normally bars from injecting raw HTML via the unfiltered_html capability - can bypass this restriction through the plugin's misconfigured save routine, planting a payload that executes in Super Admin and site visitor sessions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with administrative capabilities (PR:H confirmed by CVSS vector) - specifically the ability to edit megamenu menu-item settings within ElementsKit. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS score of 3.5 (Low) reflects the high privilege prerequisite (PR:H) and required user interaction (UI:R), which meaningfully constrain exploitability on single-site WordPress installations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with subsite Administrator credentials on a WordPress multisite network opens the ElementsKit megamenu menu-item settings and injects a JavaScript payload - such as a cookie-exfiltration script targeting wp-admin cookies - into an unsanitized field; the WPScan advisory documents a public PoC for this technique. The next time the network Super Admin visits any front-end page that renders the poisoned megamenu, the payload executes silently in their browser, exfiltrates the session token, and hands the attacker full Super Admin access over the entire multisite network. |
| Remediation | Upgrade ElementsKit Elementor Addons to version 3.10.01 or later; this is the vendor-released patch confirmed by the WPScan advisory (https://wpscan.com/vulnerability/e1eddc5a-cc5a-4665-a5c8-fcdf121be241/) and EUVD-2026-51434, and is available through the standard WordPress plugin dashboard update mechanism. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Elementskit Elementor Addons
View allRemote code execution in the ElementsKit Elementor Addons WordPress plugin before 3.10.01 allows an authenticated admini
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Tim
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Imag
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the progress bar
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Vide
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today