EUVD-2026-48093
GHSA-xqq9-frmp-38w4
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Network-delivered stored XSS requiring contributor login (PR:L) and admin view (UI:R); scope changes to victim browser; no availability impact from XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
AnalysisAI
Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor-level WordPress users to inject and persist malicious JavaScript payloads within Elementor elements. When a privileged user such as a site administrator views the affected content, the script executes in their browser session, enabling potential session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar and scope-change impact make this a meaningful internal threat for multi-author WordPress deployments.
Technical ContextAI
LA-Studio Element Kit is a WordPress plugin that extends the Elementor page builder with additional widgets and design elements, identified by CPE cpe:2.3:a:la-studio:la-studio_element_kit_for_elementor:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning one or more widget parameters accept user-supplied markup or script content without adequate sanitization or output encoding before rendering in the browser. Elementor's block-based editor grants contributor-level users the ability to craft and save rich page content, and if input is not sanitized server-side and escaped on output, a contributor can embed a persistent XSS payload. The CVSS scope change (S:C) confirms the injected script executes outside the plugin's own security context - specifically in the victim's browser - making it a classic stored XSS escalation path.
RemediationAI
Update LA-Studio Element Kit for Elementor to the version released after 1.6.2 as documented in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-cross-site-scripting-xss-vulnerability; the exact patched version number is not independently confirmed from the provided data and should be verified against the WordPress plugin repository or the vendor's changelog before deploying. As a compensating control while patching, restrict the Contributor role's ability to publish or save Elementor-built content for admin review before it becomes visible to privileged users - this limits the XSS payload's exposure window but does not eliminate the underlying vulnerability. Disabling open user registration removes the self-service attack path but does not protect against compromised internal contributor accounts. The WordPress Patchstack Firewall virtual patch may provide temporary protection for subscribers to that service.
Unauthenticated account registration bypass in the LA-Studio Element Kit for Elementor WordPress plugin (all versions be
Local File Inclusion in the LA-Studio Element Kit for Elementor WordPress plugin (all versions through 1.6.1) lets authe
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWr
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today