What is the CVSS score of CVE-2026-6565?

CVE-2026-6565 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Style Kits for Elementor CVE-2026-6565

EUVD-2026-32037 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-jjv5-rcxf-qrfr

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:40 vuln.today

CVE Published

May 27, 2026 - 02:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Style Kits - Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/wp-json/agwp/v1/tokens/save' endpoint kit title parameter in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping in an admin attribute context. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Style Kits for Elementor (analogwp-templates) WordPress plugin versions up to and including 2.5.0 allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the kit title parameter at the /wp-json/agwp/v1/tokens/save REST API endpoint. The injected script executes in the browser of any user who subsequently visits an affected page, with a Changed scope (S:C) indicating cross-user impact that can reach administrators. No public exploit identified at time of analysis; EPSS of 0.03% (9th percentile) signals low observed exploitation probability, though the contributor-level barrier is low on multi-author WordPress sites.

Technical ContextAI

The vulnerability resides in the analogwp-templates plugin (Style Kits for Elementor), which extends Elementor page builder with theme kit and style token management on WordPress. The affected REST API endpoint /wp-json/agwp/v1/tokens/save accepts a kit title parameter and persists it without adequate sanitization, then renders the stored value back into the DOM without proper output escaping in an admin attribute context. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the confirmed root cause class - a classic dual failure of missing input sanitization at write time and missing contextual output escaping at render time. The CVSS scope change flag (S:C) is consistent with stored XSS mechanics: the attacker's malicious input executes in the security context of a different user (typically a privileged admin), crossing trust boundaries beyond the attacker's own session. CVSS vector AV:N/AC:L/PR:L/UI:N reflects that exploitation is network-accessible, requires no special conditions, and - notably - marks UI:N, indicating no additional victim interaction is needed beyond normal page navigation once the payload is stored.

RemediationAI

Update Style Kits for Elementor to a version released after 2.5.0; the upstream fix is reflected in WordPress plugin SVN changeset 3530172 (https://plugins.trac.wordpress.org/changeset/3530172/analogwp-templates), which addresses the insufficient sanitization and escaping. A specific released version number incorporating this fix was not independently confirmed from the available data - verify the current version in the WordPress plugin repository changelog before deploying. As an interim compensating control, restrict REST API access to the /wp-json/agwp/v1/tokens/save route for contributor-role users using a WAF rule or a WordPress REST API restriction plugin; note this may break legitimate kit-save functionality for contributors. Alternatively, auditing and removing untrusted or unnecessary contributor accounts eliminates the attack surface entirely while the patch is staged, with no functional side effects for sites that do not rely on contributor-authored Elementor kits.