CVE-2026-103064
MediumCVSS 6.5Summary
ElementsKit Elementor addons Lite plugin has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions up to 4.0.6.
Risk Assessment
An attacker can inject malicious script that executes in the user's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the plugin to the latest version and apply input filtering mechanisms.
Other vulnerabilities in ElementsKit Elementor addons Lite
See all- CVE-2026-103063Medium
The ElementsKit Elementor addons Lite plugin for WordPress contains a Stored XSS vulnerability in versions up to and including 4.0.6. An attacker can inject malicious script that will execute in the browser of an administrator or other user.
- CVE-2026-94500Medium
Cross Site Scripting (XSS) vulnerability in the ElementsKit Elementor addons Lite plugin in versions up to and including 4.0.5. The vulnerability can be exploited by a user with Contributor privileges.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS