CVE-2026-103063 Overview
CVE-2026-103063 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting the Wpmet ElementsKit Elementor Addons Lite plugin for WordPress. The flaw results from improper neutralization of user-supplied input during web page generation. An authenticated contributor-level user can inject malicious script that persists in the application and executes in the browser of any user who views the affected page. The issue affects all versions of elementskit-lite up to and including 4.0.6.
Critical Impact
Stored XSS enables session hijacking, credential theft, and administrative action forgery when an administrator views the injected content, leading to full WordPress site compromise.
Affected Products
- Wpmet ElementsKit Elementor Addons Lite (elementskit-lite) versions up to and including 4.0.6
- WordPress sites using the plugin with contributor-or-higher user roles enabled
- Any web client rendering pages containing injected payloads
Discovery Timeline
- 2026-10-01 - CVE-2026-103063 published to the National Vulnerability Database
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-103063
Vulnerability Analysis
The vulnerability resides in the elementskit-lite plugin's handling of input used to generate web page content. The plugin fails to sanitize or encode attacker-controlled values before rendering them within the HTML response. Because the payload is persisted server-side, it executes each time the affected page loads, without further attacker interaction.
Exploitation requires low-privilege authentication and user interaction. An attacker needs an account on the target site, such as a contributor, to submit the malicious input. The scope is marked as changed, meaning the executed script runs in the context of other users, including administrators who later browse the content.
Successful exploitation can lead to theft of session cookies, forced administrative actions through CSRF-style requests, plugin or user account creation, and injection of additional backdoors. For WordPress environments, this typically escalates into full site takeover when an administrator triggers the payload.
Root Cause
The root cause is missing output encoding and insufficient input validation in one or more plugin components that render user-controlled data. Input that should be treated as untrusted text is instead emitted into HTML, attribute, or script contexts without the appropriate escaping functions such as esc_html(), esc_attr(), or wp_kses_post().
Attack Vector
The attack vector is network-based and exploitable through the WordPress authenticated interface. An attacker with at least contributor privileges submits a crafted payload through an ElementsKit widget or configuration field. The payload is stored in the database and later rendered to visitors. When a higher-privileged user views the page, the script executes in their browser context.
No verified public proof-of-concept code is available. Refer to the Patchstack XSS Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2026-103063
Indicators of Compromise
- Unexpected <script>, onerror, onload, or javascript: strings stored in wp_postmeta, wp_options, or ElementsKit widget configuration tables
- New or modified administrator accounts created shortly after a contributor-level user edited content
- Outbound HTTP requests from administrator browsers to unfamiliar domains after visiting plugin-rendered pages
- Unexpected plugin installations or theme modifications following page views by privileged users
Detection Strategies
- Audit database rows containing ElementsKit widget data for HTML event handlers and script tags
- Review WordPress audit logs for content submissions from contributor accounts followed by administrator sessions on the same URLs
- Deploy Content Security Policy (CSP) reporting to capture inline script execution violations originating from plugin-rendered pages
Monitoring Recommendations
- Monitor web server logs for POST requests to ElementsKit endpoints from low-privilege accounts
- Alert on administrative actions, such as user creation or plugin installation, that occur within short time windows after viewing contributor-authored content
- Track browser-side errors and CSP violations through centralized logging to identify active exploitation attempts
How to Mitigate CVE-2026-103063
Immediate Actions Required
- Update Wpmet ElementsKit Elementor Addons Lite to a version later than 4.0.6 as soon as a fixed release is published by the vendor
- Restrict contributor and author role assignments to trusted users only, pending patch availability
- Review all ElementsKit widgets and page content authored by non-administrator users for suspicious markup
Patch Information
The vulnerability affects elementskit-lite versions up to and including 4.0.6. Monitor the Patchstack advisory and the plugin's WordPress.org page for the fixed version number and apply it across all affected sites.
Workarounds
- Temporarily deactivate the ElementsKit Elementor Addons Lite plugin if a patch is not yet available and the plugin is non-essential
- Deploy a web application firewall (WAF) rule to block requests containing script tags or JavaScript event handlers targeting ElementsKit endpoints
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of successful injection
- Remove contributor-level publishing privileges from untrusted accounts until the plugin is updated
# Example WordPress CLI commands to disable the plugin and audit users
wp plugin deactivate elementskit-lite
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
