Elementskit Elementor Addons Lite
Monthly
Stored cross-site scripting (XSS) in ElementsKit Lite (a WordPress plugin) versions up to 4.0.6 allows an authenticated attacker with contributor or author privileges to inject malicious JavaScript into a page via a vulnerable widget, which then executes in the browser of any user who views the compromised page. The vulnerability requires a separate user to trigger the payload (UI:R) and is limited to the Lite edition; it is rated moderate severity (CVSS 6.5) with no public exploit identified at time of analysis. No evidence of elevated real-world risk or active exploitation (CISA KEV) is present.
Stored cross-site scripting (XSS) in ElementsKit Lite (ElementsKit Elementor addons Lite) versions up to and including 4.0.6 allows an authenticated attacker with contributor-level privileges to inject malicious scripts into Elementor widget content, which then execute in the browser of any user viewing the affected page. The vendor (Patchstack) rates this as medium severity with a CVSS 3.1 score of 6.5, but our assessment confirms it requires user interaction and results in partial confidentiality and integrity loss without availability impact. No public exploit code or active exploitation has been identified at time of analysis.
ElementsKit Elementor addons Lite through version 4.0.5 contains a Cross-Site Scripting flaw (CWE-79) that lets a low-privileged user plant script content which executes in a higher-privileged user's browser session. Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (CVSS vector PR:L), and the payload only fires when an administrator or other privileged user views the attacker-controlled content, making victim interaction a hard prerequisite (UI:R). The scope is rated Changed because the injected script runs in the victim's session rather than the attacker's own context, so it can act with the victim's privileges; no KEV listing or public exploit code was identified at time of analysis, and Patchstack is the reporting source. Impact is bounded to low confidentiality, integrity, and availability effects under the assessed vector, but the Changed scope means an administrator session could be abused for further actions inside the WordPress dashboard.
Stored cross-site scripting (XSS) in ElementsKit Lite (a WordPress plugin) versions up to 4.0.6 allows an authenticated attacker with contributor or author privileges to inject malicious JavaScript into a page via a vulnerable widget, which then executes in the browser of any user who views the compromised page. The vulnerability requires a separate user to trigger the payload (UI:R) and is limited to the Lite edition; it is rated moderate severity (CVSS 6.5) with no public exploit identified at time of analysis. No evidence of elevated real-world risk or active exploitation (CISA KEV) is present.
Stored cross-site scripting (XSS) in ElementsKit Lite (ElementsKit Elementor addons Lite) versions up to and including 4.0.6 allows an authenticated attacker with contributor-level privileges to inject malicious scripts into Elementor widget content, which then execute in the browser of any user viewing the affected page. The vendor (Patchstack) rates this as medium severity with a CVSS 3.1 score of 6.5, but our assessment confirms it requires user interaction and results in partial confidentiality and integrity loss without availability impact. No public exploit code or active exploitation has been identified at time of analysis.
ElementsKit Elementor addons Lite through version 4.0.5 contains a Cross-Site Scripting flaw (CWE-79) that lets a low-privileged user plant script content which executes in a higher-privileged user's browser session. Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (CVSS vector PR:L), and the payload only fires when an administrator or other privileged user views the attacker-controlled content, making victim interaction a hard prerequisite (UI:R). The scope is rated Changed because the injected script runs in the victim's session rather than the attacker's own context, so it can act with the victim's privileges; no KEV listing or public exploit code was identified at time of analysis, and Patchstack is the reporting source. Impact is bounded to low confidentiality, integrity, and availability effects under the assessed vector, but the Changed scope means an administrator session could be abused for further actions inside the WordPress dashboard.