CVE-2026-4246: ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at /wp-json/elementskit/v1/advanced-search uses permissioncallback set to returntrue, allowing unauthenticated access. Search terms are stored in the ekitadvancedsearchpopularkeyword WordPress option via updateoption(). While sanitizetextfield() is applied, it does not encode double quotes, and the stored keywords are rendered in HTML attributes via sprintf without escattr(), allowing attribute injection. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user triggers the "no results" popular keywords view on pages using the Advanced Search widget.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ElementsKit Proto a version that resolves this vulnerability.Fixed in 4.10.1 - Compensating control
Restrict access to the Advanced Search REST endpoint (/wp-json/elementskit/v1/advanced-search). The endpoint currently uses permission_callback set to __return_true (unauthenticated). Change it to require authentication/appropriate WordPress capabilities, so unauthenticated attackers cannot inject stored XSS via the 's' parameter.
Event History
Frequently Asked Questions
Does an attacker need a WordPress account or other authentication to exploit this issue?
No. The Advanced Search REST endpoint permits unauthenticated access because its permission callback is set to __return_true.
Which sites are practically exposed to script execution?
Exposure requires a vulnerable ElementsKit Pro installation and a page using the Advanced Search widget. The injected script executes when a user triggers that widget's no-results popular-keywords view.
Where is the attacker-controlled content stored?
Submitted search terms are saved in the WordPress option named ekit_advanced_search_popular_keyword. The vulnerable rendering path inserts those stored keywords into HTML attributes without attribute escaping.