CVE-2026-85302

MediumCVSS 6.5

Published: 03/09/2026(UTC)Updated: 07/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

The WPKoi Templates for Elementor WordPress plugin contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions from n/a through 3.7.2.

Risk Assessment

An attacker can exploit the vulnerability to execute malicious scripts in the victim's browser, potentially leading to data theft, session hijacking, or content manipulation.

Recommendation

Update the WPKoi Templates for Elementor plugin to the latest version that includes a fix for the XSS vulnerability.

Other vulnerabilities in WPKoi Templates for Elementor

CVE-2025-64274Medium
Missing Authorization vulnerability in wpkoithemes WPKoi Templates for Elementor (wpkoi-templates-for-elementor) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPKoi Templates for Elementor: from n/a through <= 3.4.4.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS