Elementskit Elementor Addons Advanced Widgets Templates Addons For Elementor CVE-2026-2600

CVSS score of 6.4 reflects a medium-to-moderately-high severity: network-based attack vector (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L for contributor access), and no user interaction needed (UI:N) combine to create an easily-exploitable condition. However, the scope change (S:C) and confidentiality/integrity impact (C:L/I:L) indicate cross-site effects and data compromise. The CVSS vector explicitly requires PR:L authentication, so this is not a public vulnerability-the attacker must have legitimate WordPress contributor account access or higher, which significantly reduces risk in tightly-controlled environments. The SSVC exploitation status is 'unproven' (no KEV designation, no public POC identified), making this a lower-priority patch candidate than unauthenticated RCE or actively-exploited XSS. However, sites allowing untrusted user registration or guest contributions should treat this as urgent. The practical risk depends heavily on site access controls: if only trusted administrators can create content, risk is minimal; if the site permits user-generated content or has compromised accounts, risk escalates substantially.

An authenticated attacker with WordPress contributor-level access creates or edits a page using the ElementsKit Simple Tab widget, injecting malicious JavaScript (e.g., '<script>alert("XSS")</script>') into the 'ekit_tab_title' field. The plugin fails to sanitize the input, and the script is stored in the database and rendered unescaped in the page HTML. When any site visitor-including administrators-accesses the published page, the injected script executes in their browser, potentially stealing session cookies, redirecting to phishing sites, or modifying page content. Attack complexity is low; the attacker needs only valid contributor credentials and access to the page editor.