News Kit Addons For Elementor
Monthly
Stored cross-site scripting in the News Kit Addons For Elementor WordPress plugin (all versions up to and including 1.4.8) lets an authenticated attacker with subscriber-level access or above plant arbitrary script inside a post's Elementor data, which executes for any user - typically an administrator or site visitor - who later opens the injected page. This is a genuine but mid-tier priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) is not unauthenticated, so practical exposure is concentrated on sites that permit self-registration or otherwise hand out low-privileged accounts, and the stored payload only fires when a second party views the affected page. No public exploit identified at time of analysis, and the issue is not in CISA KEV; the decision label from the priority feed is this_month.
Authenticated users with only subscriber-level access can write arbitrary post metadata under attacker-chosen keys to any post, including content owned by higher-privileged users, in News Kit Addons For Elementor through version 1.4.7. The issue is a missing capability and ownership check (CWE-862) in an authenticated AJAX action, yielding integrity-only impact per our assessment. A public PoC reference exists but is not verified as working exploit code; EPSS is 0.18% and no CISA KEV confirmation is present.
Missing authorization in News Kit Addons For Elementor before 1.4.9 lets authenticated subscriber-level users install and activate the plugin from the WordPress.org repository by calling an AJAX action that lacks a capability check. The issue is network-reachable and needs no administrator interaction, but its impact is limited to unauthorized plugin installation and activation-integrity only, with no confidentiality or availability effect-and it requires a valid low-privilege account, which is trivial on sites with open registration. A public PoC reference exists but is not verified as working exploit code; EPSS is 0.18% (7th percentile).
Stored Cross-Site Scripting in the News Kit Addons For Elementor WordPress plugin (versions ≤1.4.6) permits authenticated contributors to persistently inject arbitrary JavaScript into pages via the Site Logo Title and Single Author Box widgets by manipulating the elementor_ajax AJAX save request to bypass client-side tag-name restrictions. Every user who subsequently visits an injected page executes the attacker's script in their browser, enabling session hijacking, credential theft, or admin-level actions on their behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in version 1.4.7.
Stored cross-site scripting in the News Kit Addons For Elementor WordPress plugin (all versions up to and including 1.4.8) lets an authenticated attacker with subscriber-level access or above plant arbitrary script inside a post's Elementor data, which executes for any user - typically an administrator or site visitor - who later opens the injected page. This is a genuine but mid-tier priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) is not unauthenticated, so practical exposure is concentrated on sites that permit self-registration or otherwise hand out low-privileged accounts, and the stored payload only fires when a second party views the affected page. No public exploit identified at time of analysis, and the issue is not in CISA KEV; the decision label from the priority feed is this_month.
Authenticated users with only subscriber-level access can write arbitrary post metadata under attacker-chosen keys to any post, including content owned by higher-privileged users, in News Kit Addons For Elementor through version 1.4.7. The issue is a missing capability and ownership check (CWE-862) in an authenticated AJAX action, yielding integrity-only impact per our assessment. A public PoC reference exists but is not verified as working exploit code; EPSS is 0.18% and no CISA KEV confirmation is present.
Missing authorization in News Kit Addons For Elementor before 1.4.9 lets authenticated subscriber-level users install and activate the plugin from the WordPress.org repository by calling an AJAX action that lacks a capability check. The issue is network-reachable and needs no administrator interaction, but its impact is limited to unauthorized plugin installation and activation-integrity only, with no confidentiality or availability effect-and it requires a valid low-privilege account, which is trivial on sites with open registration. A public PoC reference exists but is not verified as working exploit code; EPSS is 0.18% (7th percentile).
Stored Cross-Site Scripting in the News Kit Addons For Elementor WordPress plugin (versions ≤1.4.6) permits authenticated contributors to persistently inject arbitrary JavaScript into pages via the Site Logo Title and Single Author Box widgets by manipulating the elementor_ajax AJAX save request to bypass client-side tag-name restrictions. Every user who subsequently visits an injected page executes the attacker's script in their browser, enabling session hijacking, credential theft, or admin-level actions on their behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in version 1.4.7.