CVE-2026-13393: ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfilteredhtml capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfilteredhtml, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13393?
CVE-2026-13393 has a risk score of 52, indicating a moderate level of severity.
How do I fix CVE-2026-13393?
To fix CVE-2026-13393, update the ElementsKit Lite plugin to version 3.10.01 or later.
What types of attacks can CVE-2026-13393 facilitate?
CVE-2026-13393 can facilitate stored XSS attacks via the megamenu menu-item settings.
Is user authentication required to exploit CVE-2026-13393?
No, CVE-2026-13393 can be exploited by users with administrative capabilities without requiring unfiltered_html capability.
What versions of ElementsKit are affected by CVE-2026-13393?
CVE-2026-13393 affects ElementsKit Lite versions prior to 3.10.01.