Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-11390
PUBLISHED
More InfoOfficial Page
Assigner-Wordfence
Assigner Org ID-b15e7b5b-3da4-40ae-a43c-f7aa60e62599
View Known Exploited Vulnerability (KEV) details
Published At-14 Jul, 2026 | 01:30
Updated At-14 Jul, 2026 | 12:31
Rejected At-
▼CVE Numbering Authority (CNA)
News Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an attacker to intercept and modify the elementor_ajax AJAX save request in order to bypass the client-side SELECT control restrictions and submit arbitrary tag-name values.

Affected Products
Vendor
blazethemes
Product
News Kit Addons For Elementor
Default Status
unaffected
Versions
Affected
  • From 0 through 1.4.6 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-79CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Type: CWE
CWE ID: CWE-79
Description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Metrics
VersionBase scoreBase severityVector
3.16.4MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Version: 3.1
Base score: 6.4
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

finder
Romain Deperne (ang3L)
Timeline
EventDate
Disclosed2026-07-13 13:07:18
Event: Disclosed
Date: 2026-07-13 13:07:18
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.wordfence.com/threat-intel/vulnerabilities/id/95b727ee-b410-471b-98f2-7cebd7f64a58?source=cve
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L50
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L58
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/single/single-author-box.php#L831
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L49
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/site-logo-title/site-logo-title.php#L50
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/site-logo-title/site-logo-title.php#L58
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/single/single-author-box.php#L831
N/A
https://plugins.trac.wordpress.org/changeset?reponame=&new=3586039%40news-kit-elementor-addons%2Ftrunk&old=3580563%40news-kit-elementor-addons%2Ftrunk
N/A
Hyperlink: https://www.wordfence.com/threat-intel/vulnerabilities/id/95b727ee-b410-471b-98f2-7cebd7f64a58?source=cve
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L50
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L58
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/single/single-author-box.php#L831
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L49
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/site-logo-title/site-logo-title.php#L50
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/site-logo-title/site-logo-title.php#L58
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/single/single-author-box.php#L831
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/changeset?reponame=&new=3586039%40news-kit-elementor-addons%2Ftrunk&old=3580563%40news-kit-elementor-addons%2Ftrunk
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Details not found