EUVD-2026-85482
GHSA-75ff-j2wh-c8v2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account
-
DeliveryInject XSS payload via plugin input
-
ExploitAdmin views poisoned content
-
ExecutionScript executes in admin browser (S:C)
-
ImpactSession hijack or privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with at least Contributor-level privileges on a site running ElementsKit Elementor addons Lite version 4.0.5 or earlier (PR:L). The injected payload does not fire until a higher-privileged user - typically an administrator - views the attacker-controlled content in the browser, so exploitation is gated on victim user interaction (UI:R) and on the target permitting Contributor-level registration or having such accounts. No special non-default plugin configuration is indicated beyond having the vulnerable plugin active. |
| Impact | This is a stored/reflected Cross-Site Scripting flaw (CWE-79) in the popular ElementsKit Elementor addons Lite plugin, reported by Patchstack with a CVSS of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector shows network reach and low complexity but requires privileges (PR:L) and victim interaction (UI:R), which materially bounds real-world impact. No EPSS score, no CISA KEV listing, and no public proof-of-concept are provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope change (S:C) reflects that a low-privileged Contributor injects script that later executes in a different (admin) security context - the genuine risk here is privilege escalation via an administrator's authenticated session rather than mass exploitation. The C:L/I:L/A:L impact triplet is generous for XSS; the availability (A:L) component is questionable and a rating with A:N (~6.4) would be defensible. Net assessment: a real but not urgent issue - a moderate-severity, authenticated, interaction-gated XSS whose priority is driven by the plugin's large install base, not by exploitation signals. |
| Exploit ScenarioDerived | An attacker who has obtained (or registered) a low-privileged Contributor account on a WordPress site running ElementsKit Lite <= 4.0.5 saves content containing a malicious script payload through an affected plugin input. When an administrator later views that content in wp-admin, the script executes in the admin's authenticated browser context, enabling actions such as creating a rogue admin or altering site settings. No public proof-of-concept is available, and success requires the admin to view the poisoned content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
ElementsKit Elementor addons Lite through version 4.0.5 contains a Cross-Site Scripting flaw (CWE-79) that lets a low-privileged user plant script content which executes in a higher-privileged user's browser session. Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (CVSS vector PR:L), and the payload only fires when an administrator or other privileged user views the attacker-controlled content, making victim interaction a hard prerequisite (UI:R). The scope is rated Changed because the injected script runs in the victim's session rather than the attacker's own context, so it can act with the victim's privileges; no KEV listing or public exploit code was identified at time of analysis, and Patchstack is the reporting source. Impact is bounded to low confidentiality, integrity, and availability effects under the assessed vector, but the Changed scope means an administrator session could be abused for further actions inside the WordPress dashboard.
RemediationAI
The primary fix is to update ElementsKit Elementor addons Lite to the first vendor release above 4.0.5 as soon as it is published; the available reference data does not specify an exact patched version number, so administrators should treat any 4.0.5-or-earlier installation as unpatched and verify the fixed version on the Patchstack advisory page (https://patchstack.com/database/wordpress/plugin/elementskit-lite/vulnerability/wordpress-elementskit-elementor-addons-lite-plugin-4-0-5-cross-site-scripting-xss-vulnerability) or the plugin's WordPress.org changelog before assuming remediation. While waiting for a fixed build, the most effective compensating control is to eliminate the low-privileged entry point: disable open registration for the Contributor role, audit and remove unneeded Contributor accounts, and demote or delete any Contributor whose content you cannot review, accepting that this restricts legitimate editorial workflows. If Contributor publishing is not required at all, deactivating the plugin removes the exposure entirely, at the cost of losing its Elementor widgets and layouts on the site. Organizations that must keep the plugin and Contributor accounts active can add a WAF or reverse-proxy rule that inspects POST bodies and stored content for script-bearing payloads targeting ElementsKit endpoints, but such rules are signature-based and prone to bypass, so pair them with a restrictive Content-Security-Policy that blocks inline script execution (with the trade-off that strict CSP may break Elementor front-end rendering and third-party widgets). Finally, review administrator workflows so privileged users avoid previewing unreviewed Contributor submissions outside a hardened browser profile, since exploitation depends on that viewing step.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the WordPress plugin ElementsKit Elementor addons Lite, distributed by Roxnor and tracked in CPE as cpe:2.3:a:roxnor:elementskit_elementor_addons_lite, which extends the Elementor page builder with additional widgets, headers, footers, and mega-menu functionality. The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. Cross-Site Scripting): content that a Contributor-level account can supply through the plugin's Elementor-based editing surfaces is rendered back into a page without adequate output encoding or sanitization, allowing HTML/JavaScript to be stored and later executed in the browser of any user who views that content. Because the plugin integrates with Elementor's front-end rendering pipeline and WordPress capability model, the trust boundary between a Contributor (who can create but not publish content) and an Administrator (who previews, approves, or views it) is the vulnerable seam. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N reflects a network-reachable, low-complexity issue gated by an authenticated low-privileged account and victim interaction, with Scope Changed and low confidentiality/integrity impact and no availability impact.
Know when Elementskit Elementor Addons Lite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Network-reachable Contributor injection (PR:L) firing in an admin browser crosses a scope boundary (S:C) with limited C/I; XSS does not produce a genuine availability impact, so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Stored cross-site scripting (XSS) in ElementsKit Lite (a WordPress plugin) versions up to 4.0.6 allows an authenticated
Stored cross-site scripting (XSS) in ElementsKit Lite (ElementsKit Elementor addons Lite) versions up to and including 4
Exploit-DB