CVE-2026-103064: ElementsKit Elementor Addons XSS Flaw

CVE-2026-103064 Overview

CVE-2026-103064 is a stored cross-site scripting (XSS) vulnerability in the Wpmet ElementsKit Elementor addons Lite WordPress plugin (elementskit-lite). The flaw affects all versions up to and including 4.0.6. An authenticated attacker with low privileges can inject malicious script content that persists in the application and executes in the browsers of users who view the affected pages. Because the vulnerability has a scope change, injected payloads can impact resources beyond the vulnerable component, including administrators who load crafted content. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated low-privilege users can store JavaScript payloads that execute in other users' sessions, enabling session theft, administrative action hijacking, and content defacement in WordPress sites running vulnerable elementskit-lite builds.

Affected Products

Wpmet ElementsKit Elementor addons Lite (elementskit-lite) versions through 4.0.6
WordPress deployments with the ElementsKit Lite plugin installed and active
Sites that permit contributor, author, or editor-level account creation using the affected plugin

Discovery Timeline

2026-10-01 - CVE-2026-103064 published to the National Vulnerability Database
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103064

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-controlled input before it is rendered in generated HTML output by the ElementsKit Lite plugin. An authenticated user supplies input to a plugin widget or configuration field that is persisted in the WordPress database. When the stored content is later rendered on a page or within the editor, the input is reflected without adequate output encoding or sanitization.

Exploitation requires low privileges (PR:L) and user interaction (UI:R), typically a victim loading the page or preview containing the payload. The scope change (S:C) indicates that script execution can affect security boundaries beyond the plugin component, such as the WordPress administrative interface. Successful execution yields limited confidentiality, integrity, and availability impact against the victim session.

Attackers commonly chain stored XSS in WordPress plugins with session riding to create new administrator accounts, inject SEO spam, or stage further plugin exploitation. See the Patchstack XSS Vulnerability Advisory for the vendor-reported technical breakdown.

Root Cause

The plugin fails to apply sufficient context-aware output escaping functions such as esc_html(), esc_attr(), or wp_kses() when rendering values submitted through widget settings. The absence of allowlisting on HTML attributes and tag content allows attackers to inject <script> tags or event-handler attributes that the browser later evaluates.

Attack Vector

The attack is network-reachable and requires an authenticated session with contribution rights to the Elementor editor. The attacker crafts a widget containing a JavaScript payload, saves the page, and waits for a privileged user to open the content in the admin dashboard or front-end preview. No code example is published; refer to the Patchstack advisory for proof-of-concept details.

Detection Methods for CVE-2026-103064

Indicators of Compromise

WordPress post or page revisions containing unexpected <script> tags, on* event handlers, or javascript: URIs within ElementsKit widget metadata
Creation of new administrator accounts shortly after an authenticated contributor edits an ElementsKit page
Outbound requests from browser sessions of admin users to unfamiliar domains immediately after loading ElementsKit-enabled pages

Detection Strategies

Audit wp_postmeta entries associated with elementskit widget keys for HTML markup containing script tags or inline event handlers
Enable Content Security Policy (CSP) violation reporting to surface inline script execution originating from WordPress admin pages
Review web server access logs for POST requests to admin-ajax.php and the Elementor editor endpoints from low-privilege accounts preceding administrative changes

Monitoring Recommendations

Alert on changes to WordPress user roles and new administrator provisioning events
Monitor plugin version inventories to confirm elementskit-lite remains above 4.0.6 after patching
Correlate browser telemetry from administrative workstations with authentication logs to detect anomalous session activity following page previews

How to Mitigate CVE-2026-103064

Immediate Actions Required

Update ElementsKit Elementor addons Lite to a version released after 4.0.6 as soon as the vendor publishes a fixed build
Restrict Elementor editing capabilities to trusted user accounts and remove unnecessary contributor or author roles
Review existing ElementsKit widget content for injected scripts and purge affected posts, pages, and templates

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 4.0.6 as affected. Administrators should consult the Patchstack XSS Vulnerability Advisory and the WordPress plugin repository for the latest fixed release and apply it through the WordPress admin update workflow.

Workarounds

Deploy a web application firewall rule that strips <script> tags and inline event handlers from requests targeting Elementor and ElementsKit editor endpoints
Enforce a strict Content Security Policy on the WordPress admin interface that disallows inline script execution
Temporarily deactivate the elementskit-lite plugin on high-value sites until a vendor patch is installed

bash

# Disable the vulnerable plugin via WP-CLI until a fix is applied
wp plugin deactivate elementskit-lite

# After updating, confirm the installed version is above 4.0.6
wp plugin get elementskit-lite --field=version