News Kit Addons For Elementor vulnerabilities

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions. This allows users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users.

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions. This allows authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor plugin from the WordPress.org repository.

The News Kit Addons For Elementor plugin for WordPress up to version 1.4.6 is vulnerable to Stored Cross-Site Scripting. The flaw exists in the Site Logo Title and Single Author Box widgets due to insufficient input sanitization and output escaping.