CVE-2026-13392

The CVE concerns ElementsKit Elementor Addons for WordPress (plugin versions before 3.10.01) where a custom-widget definition saved by a user with administrative capabilities is written verbatim into a generated PHP file and then executed by the plugin, enabling arbitrary PHP code execution on th...