CVE-2026-13392

Name of the Vulnerable Software and Affected Versions ElementsKit Elementor Addons versions prior to 3.10.01

Description An issue exists where custom-widget definitions saved by users with administrative privileges are written verbatim into a generated PHP file, which is subsequently executed by the plugin. This allows authenticated attackers with Administrator-level access or higher to achieve remote code execution on the server. In multisite network environments, this enables a subsite Administrator, who typically lacks code or file editing permissions, to execute host-level code beyond their granted privileges.

Recommendations Update ElementsKit Elementor Addons to version 3.10.01 or later.