Stored XSS in News Kit Addons For Elementor WordPress Plugin

Executive Summary

CVE-2026-11390 is a Stored Cross-Site Scripting (XSS) vulnerability in the News Kit Addons For Elementor plugin for WordPress. This vulnerability exists in versions up to and including 1.4.6.

The issue occurs due to insufficient input sanitization and output escaping in the Site Logo Title and Single Author Box Widgets. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages.

These malicious scripts will execute whenever a user accesses the affected page. Exploitation requires an attacker to intercept and modify the elementor_ajax AJAX save request to bypass client-side SELECT control restrictions, enabling them to submit arbitrary tag-name values.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for the presence of the vulnerable News Kit Addons For Elementor plugin version (up to and including 1.4.6) on your WordPress site. You can inspect the plugin version by navigating to the WordPress admin dashboard, then going to 'Plugins' and looking for 'News Kit Addons For Elementor'.

To detect potential exploitation, you can search for suspicious or injected scripts in the Site Logo Title and Single Author Box Widgets. This may involve reviewing the database or inspecting the HTML output of pages where these widgets are used.

• Check the plugin version via WP-CLI: wp plugin list --name=news-kit-addons-for-elementor --fields=name,version
• Review the database for unexpected script tags in widget fields: Use a database tool like phpMyAdmin or MySQL CLI to query the wp_postmeta table for entries related to 'elementor' and check for suspicious content in the '_elementor_data' field.
• Inspect AJAX requests in logs: Look for unusual 'elementor_ajax' requests in your web server logs, particularly those modifying widget settings or bypassing client-side restrictions.

Useful 0 Not Useful 0

Impact Analysis

If you are using the News Kit Addons For Elementor plugin on your WordPress site, this vulnerability could have several impacts:

• Attackers with contributor-level access or higher could inject malicious scripts into your website pages.
• These scripts could execute in the browsers of users visiting the infected pages, potentially leading to unauthorized actions on behalf of the users.
• Sensitive user data, such as session cookies or personal information, could be stolen.
• The integrity and trustworthiness of your website could be compromised, affecting your site's reputation.
• Malicious scripts could redirect users to phishing sites or other harmful destinations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can impact compliance with several common standards and regulations:

• GDPR (General Data Protection Regulation): If the vulnerability leads to unauthorized access or theft of personal data of EU citizens, it could result in non-compliance with GDPR. Organizations may face significant fines and legal consequences.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), a breach resulting from this vulnerability could lead to non-compliance with HIPAA, resulting in penalties and legal actions.
• PCI DSS (Payment Card Industry Data Security Standard): If the website processes payment information, this vulnerability could lead to non-compliance with PCI DSS, risking fines and the ability to process payments.

Overall, failing to address this vulnerability could result in data breaches, leading to violations of these regulations and potential legal and financial repercussions.

Useful 0 Not Useful 0

Mitigation Strategies

The following steps can help mitigate the vulnerability:

• Update the News Kit Addons For Elementor plugin to the latest version if a patch is available. This is the most effective way to resolve the issue.
• If an update is not available, consider disabling the plugin temporarily until a patch is released.
• Restrict contributor-level access to trusted users only, as exploitation requires authenticated access with contributor privileges or higher.
• Monitor and audit widget settings, particularly the Site Logo Title and Single Author Box Widgets, for any unauthorized changes or injected scripts.
• Implement a web application firewall (WAF) to block malicious AJAX requests or suspicious input patterns that could exploit this vulnerability.

Useful 0 Not Useful 0