CVE-2026-65503
MediumCVSS 6.5Summary
The Ultimate Store Kit Elementor Addons plugin versions 3.0.5 and earlier have a Cross-Site Scripting (XSS) vulnerability exploitable by a contributor. A user with contributor role can inject malicious script.
Risk Assessment
The risk includes the possibility of executing malicious script in other users' browsers, potentially leading to session theft or website defacement.
Recommendation
It is recommended to update the Ultimate Store Kit Elementor Addons plugin to a version newer than 3.0.5 that fixes this vulnerability.
Other vulnerabilities in Ultimate Store Kit Elementor Addons
See all- CVE-2026-65505Medium
The Ultimate Store Kit Elementor Addons plugin versions 3.0.5 and earlier are vulnerable to unauthenticated sensitive data exposure. Unauthenticated attackers can access confidential information.
- CVE-2026-25403Medium
The Ultimate Store Kit Elementor Addons plugin up to version 3.0.5 contains a Broken Access Control vulnerability that allows unauthenticated attackers to access functions without authorization.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.