medium · CVSS v3 6.4

CVE-2026-120524

The News Kit Addons For Elementor plugin for WordPress is vulnerable to stored XSS via the formData parameter, allowing authenticated subscr

Overview

The News Kit Addons For Elementor plugin for WordPress is vulnerable to stored XSS via the formData parameter, allowing authenticated subscribers to inject arbitrary scripts. These scripts execute whenever a user views an affected page, enabling defacement or data theft. The flaw stems from insufficient sanitization and an operator-precedence bug that exposes the admin bundle to subscriber-level screens.

Description

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because an operator-precedence bug in handle_scripts() causes the admin bundle — and its inlined nekit-admin-nonce — to be enqueued on every admin screen accessible to Subscribers (such as /wp-admin/profile.php), and because sanitize_text_field() is applied to the raw JSON string before json_decode(), allowing angle brackets encoded as \u003c/\u003e to survive sanitization and be restored to literal angle brackets, enabling overwrite of _elementor_data on any post.

Impact

Confidentiality: injected scripts can exfiltrate user data. Integrity: post content can be altered or defaced. Availability: minimal direct impact but may erode user trust. Impacted parties: WordPress site administrators, subscribers, and site visitors.

Remediation

Update the plugin to the latest version where the XSS issue is fixed. If an update is not possible, restrict subscriber access to admin screens or disable the formData feature. Implement a site-wide Content Security Policy that blocks inline scripts and enforce server-side input validation for all form data.

Risk context

Severity medium (CVSS 6.4). No EPSS data available. The vulnerability permits script injection with subscriber-level access, representing a moderate risk that should be addressed promptly.

Affected products

  • WordPress/News Kit Addons For Elementor v1.4.8

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
6.4
CVSS v4
—
EPSS
—

XSS WordPress News Kit Addons Elementor Stored XSS Subscriber Medium

← All CVEs

Related CVEs

medium

CVE-2026-105605

An IDOR flaw in the Joomla DJ-Classifieds extension allows any logged‑in user to retrieve the full details of any advertisement by supplying its numeric ID. The issue exists in all versions prior to 3.11.3 and exposes sensitive advertiser information such as phone numbers, addresses, and prices. It can be exploited without any special privileges or external access.

View analysis

medium

CVE-2026-120544

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.

View analysis

medium

CVE-2026-120551

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.

View analysis

medium

CVE-2026-120552

The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.

View analysis