CVE-2026-65482
MediumCVSS 6.5Summary
The LA-Studio Element Kit for Elementor plugin versions up to 1.6.2 contain a contributor Cross Site Scripting (XSS) vulnerability. An attacker with contributor privileges can inject malicious script.
Risk Assessment
An attacker with contributor role can inject malicious JavaScript code that executes in other users' browsers, potentially leading to session theft or redirects.
Recommendation
Immediately update the LA-Studio Element Kit plugin to the latest available version.
Other vulnerabilities in LA-Studio Element Kit for Elementor
See all- CVE-2026-65489Medium
The LA-Studio Element Kit for Elementor plugin versions up to 1.6.2 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.
- CVE-2026-65488High
The LA-Studio Element Kit for Elementor plugin version 1.6.2 and earlier has an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick an administrator into performing unwanted actions.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.