CVE-2026-94500
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in the ElementsKit Elementor addons Lite plugin in versions up to and including 4.0.5. The vulnerability can be exploited by a user with Contributor privileges.
Risk Assessment
A user with Contributor privileges can inject malicious script that executes in other users' browsers, including administrators. This may lead to session theft or account takeover.
Recommendation
Update the ElementsKit Elementor addons Lite plugin to a version newer than 4.0.5. Verify no other vulnerable plugins exist and limit the number of Contributor accounts.
Other vulnerabilities in ElementsKit Elementor addons Lite
See all- CVE-2026-103064Medium
ElementsKit Elementor addons Lite plugin has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions up to 4.0.6.
- CVE-2026-103063Medium
The ElementsKit Elementor addons Lite plugin for WordPress contains a Stored XSS vulnerability in versions up to and including 4.0.6. An attacker can inject malicious script that will execute in the browser of an administrator or other user.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS