CVE-2026-103064: WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Q: Which installations are affected?

ElementsKit Elementor addons Lite versions through 4.0.6 are affected. The available data does not identify a safe fixed version.

Q: What level of access does an attacker need?

The vector indicates network-reachable exploitation with low privileges required and user interaction required. The issue is a stored XSS vulnerability, so injected content may persist and execute when another user views the affected page or content.

Q: What is the potential impact?

The supplied severity vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful exploitation may allow script execution in a victim's browser in the context of the affected WordPress site.

Published Oct 1, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

Affected Software

1 affected component

Wpmet ElementsKit Elementor addons Lite<=4.0.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/elementskit-lite to a version that resolves this vulnerability.
Fixed in 4.0.7

Event History

Oct 1, 2026

CVE Published

via MITRE·12:32 PM

Data Sourced

via MITRE·12:32 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

ElementsKit Elementor addons Lite versions through 4.0.6 are affected. The available data does not identify a safe fixed version.

What level of access does an attacker need?

The vector indicates network-reachable exploitation with low privileges required and user interaction required. The issue is a stored XSS vulnerability, so injected content may persist and execute when another user views the affected page or content.

What is the potential impact?

The supplied severity vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful exploitation may allow script execution in a victim's browser in the context of the affected WordPress site.

CVE-2026-103064: WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What is the potential impact?