La Studio
Monthly
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote unauthenticated attacker forge state-changing requests that, per the Patchstack advisory, chain into a Stored Cross-Site Scripting condition. By luring a logged-in user (typically an administrator) into visiting a crafted page, the attacker persists malicious script into the site. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; exploitation hinges on victim interaction rather than any authentication of the attacker.
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers to bypass authorization checks and access restricted content or plugin functionality on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity, unauthenticated network exploitation with a limited confidentiality impact and no data integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor-level WordPress users to inject and persist malicious JavaScript payloads within Elementor elements. When a privileged user such as a site administrator views the affected content, the script executes in their browser session, enabling potential session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar and scope-change impact make this a meaningful internal threat for multi-author WordPress deployments.
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote unauthenticated attacker forge state-changing requests that, per the Patchstack advisory, chain into a Stored Cross-Site Scripting condition. By luring a logged-in user (typically an administrator) into visiting a crafted page, the attacker persists malicious script into the site. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; exploitation hinges on victim interaction rather than any authentication of the attacker.
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers to bypass authorization checks and access restricted content or plugin functionality on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity, unauthenticated network exploitation with a limited confidentiality impact and no data integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor-level WordPress users to inject and persist malicious JavaScript payloads within Elementor elements. When a privileged user such as a site administrator views the affected content, the script executes in their browser session, enabling potential session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar and scope-change impact make this a meaningful internal threat for multi-author WordPress deployments.