CVE-2026-103063
MediumCVSS 6.5Summary
The ElementsKit Elementor addons Lite plugin for WordPress contains a Stored XSS vulnerability in versions up to and including 4.0.6. An attacker can inject malicious script that will execute in the browser of an administrator or other user.
Risk Assessment
Risk includes session hijacking of administrators, data theft, content modification, or spreading malware to site visitors.
Recommendation
Update the ElementsKit Elementor addons Lite plugin to the latest version that includes the security fix.
Other vulnerabilities in ElementsKit Elementor addons Lite
See all- CVE-2026-103064Medium
ElementsKit Elementor addons Lite plugin has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions up to 4.0.6.
- CVE-2026-94500Medium
Cross Site Scripting (XSS) vulnerability in the ElementsKit Elementor addons Lite plugin in versions up to and including 4.0.5. The vulnerability can be exploited by a user with Contributor privileges.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS