La Studio Element Kit For Elementor
Monthly
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers to bypass authorization checks and access restricted content or plugin functionality on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity, unauthenticated network exploitation with a limited confidentiality impact and no data integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote unauthenticated attacker forge state-changing requests that, per the Patchstack advisory, chain into a Stored Cross-Site Scripting condition. By luring a logged-in user (typically an administrator) into visiting a crafted page, the attacker persists malicious script into the site. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; exploitation hinges on victim interaction rather than any authentication of the attacker.
Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor-level WordPress users to inject and persist malicious JavaScript payloads within Elementor elements. When a privileged user such as a site administrator views the affected content, the script executes in their browser session, enabling potential session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar and scope-change impact make this a meaningful internal threat for multi-author WordPress deployments.
Local File Inclusion in the LA-Studio Element Kit for Elementor WordPress plugin (all versions through 1.6.1) lets authenticated contributors and above coerce the get_type_template function into including arbitrary server-side .php files, enabling access-control bypass, sensitive data disclosure, and full PHP code execution where an attacker can plant a .php file. Reported by Wordfence with a CVSS 3.1 base score of 7.5; no public exploit identified at time of analysis and it is not listed in CISA KEV. The flaw stems from wp_normalize_path being relied upon for path safety even though it only canonicalizes separators and never rejects traversal sequences.
Unauthenticated account registration bypass in the LA-Studio Element Kit for Elementor WordPress plugin (all versions before 1.6.1) allows remote, unauthenticated attackers to create WordPress user accounts on sites where site-wide registration has been explicitly disabled by the administrator. The vulnerable component is an unauthenticated AJAX action handler that omits the standard WordPress registration-status check, effectively nullifying an administrative security control. A publicly available proof-of-concept exists via WPScan, and a vendor patch is available in version 1.6.1; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widgets in all versions up to, and including,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers to bypass authorization checks and access restricted content or plugin functionality on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity, unauthenticated network exploitation with a limited confidentiality impact and no data integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-Site Request Forgery in the LA-Studio Element Kit for Elementor WordPress plugin (versions <= 1.6.2) lets a remote unauthenticated attacker forge state-changing requests that, per the Patchstack advisory, chain into a Stored Cross-Site Scripting condition. By luring a logged-in user (typically an administrator) into visiting a crafted page, the attacker persists malicious script into the site. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; exploitation hinges on victim interaction rather than any authentication of the attacker.
Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor-level WordPress users to inject and persist malicious JavaScript payloads within Elementor elements. When a privileged user such as a site administrator views the affected content, the script executes in their browser session, enabling potential session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar and scope-change impact make this a meaningful internal threat for multi-author WordPress deployments.
Local File Inclusion in the LA-Studio Element Kit for Elementor WordPress plugin (all versions through 1.6.1) lets authenticated contributors and above coerce the get_type_template function into including arbitrary server-side .php files, enabling access-control bypass, sensitive data disclosure, and full PHP code execution where an attacker can plant a .php file. Reported by Wordfence with a CVSS 3.1 base score of 7.5; no public exploit identified at time of analysis and it is not listed in CISA KEV. The flaw stems from wp_normalize_path being relied upon for path safety even though it only canonicalizes separators and never rejects traversal sequences.
Unauthenticated account registration bypass in the LA-Studio Element Kit for Elementor WordPress plugin (all versions before 1.6.1) allows remote, unauthenticated attackers to create WordPress user accounts on sites where site-wide registration has been explicitly disabled by the administrator. The vulnerable component is an unauthenticated AJAX action handler that omits the standard WordPress registration-status check, effectively nullifying an administrative security control. A publicly available proof-of-concept exists via WPScan, and a vendor patch is available in version 1.6.1; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widgets in all versions up to, and including,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.