CVE-2026-65488

Deferred Deferred - Pending Action

Unauthenticated CSRF in LA-Studio Element Kit for Elementor

Publication date: 2026-07-23

Last updated on: 2026-09-30

Assigner: Patchstack

Description

Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-09-30

Generated

2026-10-12

AI Q&A

2026-07-23

EPSS Evaluated

2026-10-11

NVD

CVE-2026-65488

EUVD

EUVD-2026-48099

Affected Vendors & Products

Vendor	Product	Version / Range
la-studio	element_kit_for_elementor	to 1.6.2 (inc)
la-studio	element_kit	to 1.6.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an Unauthenticated Cross Site Request Forgery (CSRF) in the LA-Studio Element Kit for Elementor plugin versions up to and including 1.6.2. CSRF allows attackers to trick users into executing unwanted actions on a web application where they are authenticated, without their knowledge or consent.

Detection Guidance

Detecting this CSRF vulnerability requires checking for outdated versions of the LA-Studio Element Kit plugin. Inspect your WordPress installation for the plugin version. If it is <= 1.6.2, the system is vulnerable. No specific commands are provided in the context, but you can use WordPress admin panel or file system checks to verify the plugin version.

Impact Analysis

This vulnerability could allow attackers to perform unauthorized actions on your website if you are using a vulnerable version of the LA-Studio Element Kit for Elementor. These actions could include modifying content, changing settings, or taking administrative actions without your knowledge.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is classified as low severity with no significant threat. The CSRF vulnerability requires user interaction and has limited impact on data integrity or confidentiality.

Mitigation Strategies

Update LA-Studio Element Kit for Elementor to the latest version (1.6.2 or higher) to patch the CSRF vulnerability. If an update is not available, consider disabling the plugin temporarily until a fix is released.

Hi! I’m here to help you understand CVE-2026-65488. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70