What is the CVSS score of EUVD-2026-51434?

EUVD-2026-51434 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for EUVD-2026-51434?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51434. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for EUVD-2026-51434?

Yes, a patch is available for EUVD-2026-51434. Update the affected software to the latest version immediately.

ElementsKit Elementor Addons EUVD-2026-51434

| CVE-2026-13393 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-31 WPScan

GHSA-5fj7-xcmr-5r75

WordPress XSS Elementskit Elementor Addons Unknown

3.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

3.5 LOW

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Scope changed to C because multisite subsite admin can compromise Super Admin session across trust boundaries; PR:H and UI:R retained as admin credentials and victim page load are both required.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:35 vuln.today

CVSS changed

Jul 31, 2026 - 18:37 NVD

3.5 (LOW)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

LOW 3.5

DescriptionCVE.org

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfiltered_html, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.

AnalysisAI

Stored XSS in ElementsKit Elementor Addons (WordPress plugin before 3.10.01) allows administrative users to inject malicious JavaScript into megamenu menu-item settings, which is rendered unsanitized to all page visitors. The most critical exploitation path targets WordPress multisite networks: a subsite Administrator - a role WordPress normally bars from injecting raw HTML via the unfiltered_html capability - can bypass this restriction through the plugin's misconfigured save routine, planting a payload that executes in Super Admin and site visitor sessions. A publicly available proof-of-concept exists per WPScan; EPSS is low (0.16%) but SSVC flags total technical impact due to the Super Admin session takeover potential on multisite deployments.

Technical ContextAI

CWE-79 (Stored Cross-Site Scripting) arises because ElementsKit Elementor Addons fails to sanitize or escape user-supplied data in megamenu menu-item configuration fields before persisting it to the database and rendering it on the front end. Critically, the plugin's save handler does not enforce WordPress's unfiltered_html capability check, which is the platform's primary gate for restricting raw HTML injection to privileged roles (Super Admins by default on multisite networks). The affected product is identified by CPE cpe:2.3:a:unknown:elementskit_elementor_addons:*:*:*:*:*:*:*:* across all versions before 3.10.01. This class of flaw is common in Elementor ecosystem add-ons where custom meta save hooks bypass WordPress's default content filtering pipeline (wp_kses), allowing lower-trust roles to persist arbitrary HTML where the core platform would otherwise block it.

RemediationAI

Upgrade ElementsKit Elementor Addons to version 3.10.01 or later; this is the vendor-released patch confirmed by the WPScan advisory (https://wpscan.com/vulnerability/e1eddc5a-cc5a-4665-a5c8-fcdf121be241/) and EUVD-2026-51434, and is available through the standard WordPress plugin dashboard update mechanism. For multisite operators who cannot patch immediately, restricting the subsite Administrator role exclusively to fully trusted personnel eliminates the privilege-escalation path, since the unfiltered_html bypass only grants meaningful escalation when exploited by a role that should not already hold Super Admin trust. Disabling the ElementsKit megamenu feature at the plugin settings level also removes the vulnerable attack surface without a full uninstall, though doing so will break megamenu-dependent navigation until patching is completed. Generic capability restrictions (e.g., removing edit_theme_options from subsite admins) may disrupt legitimate workflows and should be tested before deployment.