CVE-2026-6565
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Style Kits plugin for WordPress up to version 2.5.0 has a Stored XSS vulnerability via the kit title parameter in the '/wp-json/agwp/v1/tokens/save' endpoint. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever a user visits an infected page.
Risk Assessment
An attacker can steal session cookies, redirect users to malicious sites, or modify page content.
Recommendation
Update the Style Kits plugin to the latest version and apply proper input filtering.
Other vulnerabilities in Style Kits
See all- CVE-2026-65484Medium
The Style Kits plugin versions up to 2.6.5 contain a contributor broken access control vulnerability. An attacker with contributor privileges can bypass access control mechanisms.
- CVE-2026-27364Medium
Style Kits versions up to 2.6.5 have a Subscriber Broken Access Control vulnerability, allowing subscribers to access unauthorized functionality.
Original NVD description (English source)
The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/wp-json/agwp/v1/tokens/save' endpoint kit title parameter in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping in an admin attribute context. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.