EUVD-2026-48099
GHSA-jg9x-3fmg-q9m3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated remote CSRF (PR:N, AV:N, AC:L) but requires a logged-in victim to click (UI:R); resulting stored XSS runs in the browser context (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
AnalysisAI
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote unauthenticated attacker forge state-changing requests that, per the Patchstack advisory, chain into a Stored Cross-Site Scripting condition. By luring a logged-in user (typically an administrator) into visiting a crafted page, the attacker persists malicious script into the site. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; exploitation hinges on victim interaction rather than any authentication of the attacker.
Technical ContextAI
The affected component is LA-Studio Element Kit for Elementor, an add-on plugin that extends the Elementor page builder for WordPress with additional widgets and templates. The root cause is CWE-352 (Cross-Site Request Forgery): one or more of the plugin's request handlers perform state-changing actions without validating an anti-CSRF nonce or verifying request origin, so the server cannot distinguish a legitimate in-session action from a forged one triggered by a third-party page. Because the Patchstack reference describes a CSRF-to-Stored-XSS chain, the forged request ultimately writes attacker-controlled data that is stored and later rendered without proper output encoding, giving the CSRF a persistent script-injection payoff. The CPE cpe:2.3:a:la-studio:la-studio_element_kit_for_elementor covers all versions up to and including 1.6.2.
RemediationAI
Update the LA-Studio Element Kit for Elementor plugin to the first release published after 1.6.2 (the provided data confirms 1.6.2 and earlier are vulnerable but does not state the exact patched version; verify the fixed release on the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-cross-site-request-forgery-csrf-to-stored-xss-vulnerability or the WordPress plugin repository before deploying). Until patched, deploy a Web Application Firewall (Patchstack or equivalent) with a virtual patch for this CVE, which blocks the forged requests with minimal functional side effects. As compensating controls, restrict wp-admin access to trusted IPs or behind SSO to reduce the pool of interactable authenticated victims, and instruct administrators to avoid clicking untrusted links while logged in; if the plugin is not actively used, deactivate and remove it to eliminate the attack surface, at the cost of losing the affected Elementor widgets.
Unauthenticated account registration bypass in the LA-Studio Element Kit for Elementor WordPress plugin (all versions be
Local File Inclusion in the LA-Studio Element Kit for Elementor WordPress plugin (all versions through 1.6.1) lets authe
Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWr
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today