CVE-2026-85302: WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS.
This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPKoi Templates for Elementor Pluginto a version that resolves this vulnerability.Fixed in 3.7.3
Event History
Frequently Asked Questions
What level of access and interaction are required to exploit this issue?
The CVSS vector indicates an attacker needs low-level privileges and user interaction. The vulnerability is remotely reachable and has low attack complexity.
Which installations are affected?
WPKoi Templates for Elementor versions through 3.7.2 are affected. The provided information does not state whether a fixed version is available or whether the vulnerable behavior is enabled by default.
What impact could successful exploitation have?
Successful DOM-based XSS can affect confidentiality, integrity, and availability at low impact levels. Because the scope is changed, the impact may extend beyond the vulnerable plugin's security authority.