CVE-2026-13393

Name of the Vulnerable Software and Affected Versions ElementsKit Elementor Addons versions prior to 3.10.01

Description The plugin fails to sanitize or escape specific megamenu menu-item settings before they are stored and displayed on the front end. Additionally, the system does not require the unfiltered html capability to save these settings. This allows users with administrative privileges to store malicious JavaScript. In a multisite network environment, a subsite Administrator without unfiltered html permissions can execute a stored Cross-Site Scripting (XSS) attack—a technique where malicious scripts are injected into a trusted website—targeting the sessions of the network Super Admin and general site visitors.

Recommendations Update ElementsKit Elementor Addons to version 3.10.01 or later.