CVE-2026-13392

HighCVSS 7.2

Published: 31/07/2026(UTC)Updated: 26/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that is subsequently executed, allowing arbitrary PHP code to run on the server. On a multisite network, a non-super subsite Administrator can reach host-level code execution.

Risk Assessment

An attacker can take over the server, steal data, or install a backdoor.

Recommendation

Update the ElementsKit Elementor Addons plugin to version 3.10.01 or later.

Other vulnerabilities in ElementsKit Elementor Addons

CVE-2026-13393Low
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing and outputting them, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript. On a multisite network, this lets a non-super subsite Administrator plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.

Original NVD description (English source)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them.