CVE-2026-97352
UnknownSummary
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions. This allows authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor plugin from the WordPress.org repository.
Risk Assessment
Low-privileged users can install and activate plugins, potentially leading to unauthorized changes in site configuration and use for further attacks.
Recommendation
Update the News Kit Addons For Elementor plugin to version 1.4.9 or later, which includes the capability check fix.
Other vulnerabilities in News Kit Addons For Elementor
See all- CVE-2026-97353Unknown
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions. This allows users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users.
- CVE-2026-11390Medium
The News Kit Addons For Elementor plugin for WordPress up to version 1.4.6 is vulnerable to Stored Cross-Site Scripting. The flaw exists in the Site Logo Title and Single Author Box widgets due to insufficient input sanitization and output escaping.
Original NVD description (English source)
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS