CVE-2026-4246

Name of the Vulnerable Software and Affected Versions ElementsKit Pro versions prior to 4.10.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. The REST endpoint '/wp-json/elementskit/v1/advanced-search' allows unauthenticated access because the permission callback is set to return true. Search terms provided via the s parameter are stored in the ekit advanced search popular keyword WordPress option using the update option() function. Although sanitize text field() is used, it fails to encode double quotes, and the stored keywords are rendered in HTML attributes via sprintf() without using esc attr(), enabling attribute injection. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user triggers the popular keywords view during a no-results search on pages using the Advanced Search widget.

Recommendations Update ElementsKit Pro to version 4.10.2 or later. As a temporary mitigation, restrict access to the '/wp-json/elementskit/v1/advanced-search' endpoint or avoid using the Advanced Search widget.