Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2026-11390
Deferred
More InfoOfficial Page
Source-security@wordfence.com
View Known Exploited Vulnerability (KEV) details
Published At-14 Jul, 2026 | 02:16
Updated At-14 Jul, 2026 | 15:26

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an attacker to intercept and modify the elementor_ajax AJAX save request in order to bypass the client-side SELECT control restrictions and submit arbitrary tag-name values.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.16.4MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
N/A
Type: Secondary
Version: 3.1
Base score: 6.4
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Type: N/A
Version:
Base score:
Base severity: N/A
Vector:
CPE Matches

Weaknesses
CWE IDTypeSource
CWE-79Secondarysecurity@wordfence.com
CWE ID: CWE-79
Type: Secondary
Source: security@wordfence.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/single/single-author-box.php#L831security@wordfence.com
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L49security@wordfence.com
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L50security@wordfence.com
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L58security@wordfence.com
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/single/single-author-box.php#L831security@wordfence.com
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/site-logo-title/site-logo-title.php#L50security@wordfence.com
N/A
https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/site-logo-title/site-logo-title.php#L58security@wordfence.com
N/A
https://plugins.trac.wordpress.org/changeset?reponame=&new=3586039%40news-kit-elementor-addons%2Ftrunk&old=3580563%40news-kit-elementor-addons%2Ftrunksecurity@wordfence.com
N/A
https://www.wordfence.com/threat-intel/vulnerabilities/id/95b727ee-b410-471b-98f2-7cebd7f64a58?source=cvesecurity@wordfence.com
N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/single/single-author-box.php#L831
Source: security@wordfence.com
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L49
Source: security@wordfence.com
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L50
Source: security@wordfence.com
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.2/includes/widgets/site-logo-title/site-logo-title.php#L58
Source: security@wordfence.com
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/single/single-author-box.php#L831
Source: security@wordfence.com
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/site-logo-title/site-logo-title.php#L50
Source: security@wordfence.com
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/news-kit-elementor-addons/tags/1.4.7/includes/widgets/site-logo-title/site-logo-title.php#L58
Source: security@wordfence.com
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/changeset?reponame=&new=3586039%40news-kit-elementor-addons%2Ftrunk&old=3580563%40news-kit-elementor-addons%2Ftrunk
Source: security@wordfence.com
Resource: N/A
Hyperlink: https://www.wordfence.com/threat-intel/vulnerabilities/id/95b727ee-b410-471b-98f2-7cebd7f64a58?source=cve
Source: security@wordfence.com
Resource: N/A
Change History
0Changes found

Details not found