CVE-2026-97353
UnknownSummary
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions. This allows users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users.
Risk Assessment
Attackers can overwrite protected core metadata and tamper with content created by higher-privileged users, leading to data integrity violations and potential further attacks.
Recommendation
Update the News Kit Addons For Elementor plugin to a version newer than 1.4.7, which includes the capability and ownership check fix.
Other vulnerabilities in News Kit Addons For Elementor
See all- CVE-2026-97352Unknown
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions. This allows authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor plugin from the WordPress.org repository.
- CVE-2026-11390Medium
The News Kit Addons For Elementor plugin for WordPress up to version 1.4.6 is vulnerable to Stored Cross-Site Scripting. The flaw exists in the Site Logo Title and Single Author Box widgets due to insufficient input sanitization and output escaping.
Original NVD description (English source)
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS