What is the CVSS score of EUVD-2026-18979?

EUVD-2026-18979 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Elementskit Elementor Addons Advanced Widgets Templates Addons For Elementor EUVD-2026-18979

| CVE-2026-2600 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-04 Wordfence

WordPress XSS Elementskit Elementor Addons Advanced Widgets Templates Addons For Elementor Wordpress Plugin Roxnor

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 07:45 euvd

EUVD-2026-18979

Analysis Generated

Apr 04, 2026 - 07:45 vuln.today

CVE Published

Apr 04, 2026 - 07:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ekit_tab_title' parameter in the Simple Tab widget in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in ElementsKit Elementor Addons and Templates plugin (versions up to 3.7.9) allows authenticated contributors and above to inject malicious scripts via the 'ekit_tab_title' parameter in the Simple Tab widget due to insufficient input sanitization and output escaping. Injected scripts execute when users access affected pages. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the ElementsKit Elementor Addons plugin, a widely-used WordPress Elementor extension that provides advanced widgets and page-building capabilities. The Simple Tab widget fails to properly sanitize and escape user-supplied input in the 'ekit_tab_title' parameter before rendering it in the page output. This is a Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation), where malicious HTML and JavaScript are persisted in the database and executed in the browsers of all users who view the affected page. The attack surface is limited to authenticated users with contributor-level access or higher, but the impact extends to all site visitors once a page with injected content is published.

RemediationAI

Update ElementsKit Elementor Addons to version 3.8.0 or later, which includes fixes for input sanitization and output escaping in the Simple Tab widget's 'ekit_tab_title' parameter. Administrators should navigate to the WordPress plugin dashboard, locate ElementsKit Elementor Addons, and apply the available update. Until patched, restrict contributor-level and above access to users who are fully trusted; audit existing tab widgets for suspicious content using the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset/3468265/elementskit-lite/trunk/widgets/tab/tab.php to understand the applied fix. For additional details, consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4c33c640-0876-4b07-829e-35cae445b420?source=cve.