CVE-2026-25403
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Ultimate Store Kit Elementor Addons plugin up to version 3.0.5 contains a Broken Access Control vulnerability that allows unauthenticated attackers to access functions without authorization.
Risk Assessment
An unauthenticated attacker could exploit this to modify settings or data, potentially leading to full site compromise.
Recommendation
Update the plugin to the latest version and implement proper access controls.
Other vulnerabilities in Ultimate Store Kit Elementor Addons
See all- CVE-2026-65505Medium
The Ultimate Store Kit Elementor Addons plugin versions 3.0.5 and earlier are vulnerable to unauthenticated sensitive data exposure. Unauthenticated attackers can access confidential information.
- CVE-2026-65503Medium
The Ultimate Store Kit Elementor Addons plugin versions 3.0.5 and earlier have a Cross-Site Scripting (XSS) vulnerability exploitable by a contributor. A user with contributor role can inject malicious script.
Original NVD description (English source)
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.