CVE-2026-94500 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...

CVE-2026-94500

The ElementsKit Elementor addons Lite WordPress plugin is vulnerable to a Contributor Cross Site Scripting (XSS) vulnerability in versions

CVE-2026-94500 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ElementsKit Elementor addons Lite versions = 4.0.5...

CVE-2026-94500: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...

PT-2026-97467

Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...

CVE-2026-4246

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...

WordPress ElementsKit Pro plugin <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 's' Parameter vulnerability discovered by Ren Voza in WordPress Plugin ElementsKit Pro versions = 4.10.1...

CVE-2026-4246

ElementsKit Pro (WordPress plugin) versions up to and including 4.10.1 are affected by an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability via the s parameter of the Advanced Search REST endpoint at /wp-json/elementskit/v1/advanced-search. The endpoint uses permission_callback set ...

CVE-2026-4246 ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...

CVE-2026-4246 ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...

EUVD-2026-67564

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...

CVE-2026-4246: Improper Neutralization of Input During Web Page Generation

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...

PT-2026-82878

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...

WordPress ElementsKit Elementor Addons plugin < 3.10.01 - Subsite Administrator+ PHP Code Injection vulnerability

Subsite Administrator+ PHP Code Injection vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ElementsKit Elementor addons Lite versions 3.10.01...

CVE-2026-13392

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently...

CVE-2026-13393

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfilteredhtml capability to save them, allowing users with administrative capabiliti...

CVE-2026-13393

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfilteredhtml capability to save them, allowing users with administrative capabiliti...

CVE-2026-13393

The ElementsKit Elementor Addons WordPress plugin (versions before 3.10.01 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitize or escape specific megamenu menu-item settings before storage and front-end output, while also failing to require the u...

WordPress ElementsKit Elementor Addons plugin < 3.10.01 - Subsite Administrator+ Stored XSS vulnerability

Subsite Administrator+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ElementsKit Elementor addons Lite versions 3.10.01...