LA-Studio Element Kit CVE-2026-65488

Exploitation requires an active WordPress site running LA-Studio Element Kit for Elementor version 1.6.2 or earlier, and - because the CVSS vector specifies UI:R - a currently logged-in victim (in practice an administrator or privileged user whose session can perform the state-changing action) must be induced to visit an attacker-controlled page while authenticated. The attacker themselves needs no account (PR:N, unauthenticated CSRF) and no special network position beyond a reachable public site (AV:N). The primary limiting factors are this mandatory victim interaction and the need for the victim to hold a valid authenticated session at the moment of the forged request; there is no evidence of a non-default configuration prerequisite in the provided data.

The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting a remotely reachable, low-complexity flaw requiring no attacker privileges but mandatory user interaction, with a scope change and low confidentiality, integrity, and availability impact - consistent with a CSRF that pivots into stored XSS executing in the victim's browser context. The UI:R requirement is the dominant limiting factor: an authenticated victim (ideally an administrator) must be socially engineered into visiting a malicious page, which lowers real-world exploitability versus a fully automatable network flaw. No EPSS score, SSVC decision, KEV listing, or public PoC was provided, so exploitation probability cannot be quantified from the input; the absence of KEV and PoC signals suggests this is not currently subject to mass exploitation. Overall this is a moderate-priority issue for sites running the plugin - worth patching promptly given the stored-XSS payoff and admin-targeting potential, but not an emergency absent active-exploitation evidence.

An attacker crafts a web page containing a hidden auto-submitting form or request targeting the vulnerable plugin endpoint and lures a logged-in WordPress administrator to open it via a phishing email or a link on a forum. Because the endpoint does not validate a CSRF nonce, the victim's browser silently submits the state-changing request, injecting a persistent XSS payload that later executes in the browsers of anyone viewing the affected content. No public proof-of-concept was provided, but the low attack complexity (AC:L) makes the forged request itself trivial to construct once the vulnerable action is known.