CVE-2026-11390

Name of the Vulnerable Software and Affected Versions News Kit Addons For Elementor versions prior to 1.4.7

Description Stored Cross-Site Scripting occurs in the Site Logo Title and Single Author Box Widgets due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user visits the affected page. Exploitation involves intercepting and modifying the elementor ajax AJAX save request to bypass client-side SELECT control restrictions and submit arbitrary tag-name values.

Recommendations Update News Kit Addons For Elementor to version 1.4.7 or later.