CVE-2026-103064: WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/elementskit-liteto a version that resolves this vulnerability.Fixed in 4.0.7
Event History
Frequently Asked Questions
Which installations are affected?
ElementsKit Elementor addons Lite versions through 4.0.6 are affected. The available data does not identify a safe fixed version.
What level of access does an attacker need?
The vector indicates network-reachable exploitation with low privileges required and user interaction required. The issue is a stored XSS vulnerability, so injected content may persist and execute when another user views the affected page or content.
What is the potential impact?
The supplied severity vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful exploitation may allow script execution in a victim's browser in the context of the affected WordPress site.