News Kit Elementor Addons
Monthly
PHP object injection in the BlazeThemes News Kit Elementor Addons plugin for WordPress, affecting versions up to and including 1.5.0, allows an authenticated attacker holding only a subscriber-level account to supply data that the plugin deserializes unsafely, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicating possible full compromise of confidentiality, integrity and availability of the WordPress site. Exploitation is gated by the low-privilege account requirement, so it is realistically reachable where self-registration is open or where an attacker already holds a subscriber account; no user interaction or elevated role is needed. At time of analysis there is no CISA KEV listing and no public exploit identified, and the actual outcome depends on a usable POP gadget chain being reachable in the plugin or co-installed code, which the available sources do not confirm.
The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
PHP object injection in the BlazeThemes News Kit Elementor Addons plugin for WordPress, affecting versions up to and including 1.5.0, allows an authenticated attacker holding only a subscriber-level account to supply data that the plugin deserializes unsafely, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicating possible full compromise of confidentiality, integrity and availability of the WordPress site. Exploitation is gated by the low-privilege account requirement, so it is realistically reachable where self-registration is open or where an attacker already holds a subscriber account; no user interaction or elevated role is needed. At time of analysis there is no CISA KEV listing and no public exploit identified, and the actual outcome depends on a usable POP gadget chain being reachable in the plugin or co-installed code, which the available sources do not confirm.
The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.