CVE-2026-11390: News Kit Addons XSS Vulnerability

CVE-2026-11390 Overview

CVE-2026-11390 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the News Kit Addons For Elementor plugin for WordPress. The flaw exists in the Site Logo Title and Single Author Box widgets in all versions up to and including 1.4.6. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or above to inject arbitrary JavaScript into rendered pages. The injected scripts execute in the browser of any user who accesses an affected page, enabling session theft, redirect chains, and further client-side attacks. Exploitation requires bypassing client-side SELECT control restrictions in the Elementor editor by intercepting and modifying the elementor_ajax save request.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in any visitor's browser session, including administrators, enabling account takeover and site compromise.

Affected Products

News Kit Addons For Elementor plugin for WordPress — all versions up to and including 1.4.6
WordPress sites running Elementor with this addon
Site Logo Title and Single Author Box widget components

Discovery Timeline

2026-07-14 - CVE-2026-11390 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-11390

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. It affects two widgets shipped by the News Kit Addons For Elementor plugin: Site Logo Title and Single Author Box. Both widgets accept a tag_name attribute that determines the HTML element used to render user-supplied content. The plugin uses a client-side SELECT control to restrict the tag name to a whitelist of safe values such as h1 through h6, div, and span. This restriction is enforced only in the editor UI, not on the server.

When the widget renders, the supplied tag name is written directly into the output markup without server-side validation or escaping. An attacker who submits an arbitrary value in place of a legitimate tag name can break out of the intended element context and inject a full HTML tag containing an event handler or script payload. The stored payload executes whenever any user renders the page containing the widget.

Root Cause

The root cause is missing server-side validation of the tag_name attribute in the widget render functions. See the Site Logo Title widget code and the Single Author Box widget code. The plugin trusts the client-side SELECT whitelist and never re-validates the value against a server-side allowlist before emitting the tag into the DOM.

Attack Vector

An authenticated attacker with contributor privileges or higher edits a page that uses the Site Logo Title or Single Author Box widget. Using a web proxy, the attacker intercepts the elementor_ajax save request that carries the widget settings. The attacker modifies the tag_name field in the JSON payload to include an arbitrary tag with an inline event handler, then forwards the request. WordPress stores the payload in wp_postmeta. When any visitor loads the page, the injected element is rendered and the event handler fires in that visitor's browser context. See the Wordfence Vulnerability Analysis for additional detail.

Detection Methods for CVE-2026-11390

Indicators of Compromise

Unexpected HTML tags, on* event handlers, or <script> elements stored in wp_postmeta rows associated with Elementor data (_elementor_data).
elementor_ajax POST requests where the tag_name widget setting contains characters outside a strict alphanumeric allowlist.
Outbound requests from visitor browsers to unfamiliar domains shortly after loading pages that render the affected widgets.
New or modified administrator accounts created shortly after a contributor edits pages containing the affected widgets.

Detection Strategies

Query the wp_postmeta table for _elementor_data entries matching the affected widget types and inspect the tag_name values for anything other than expected heading or block tags.
Deploy WAF signatures that inspect admin-ajax.php requests with action=elementor_ajax and flag tag_name payloads containing angle brackets, quotes, or event handler keywords.
Enable request body logging for authenticated admin-ajax.php traffic and baseline the expected values for widget attributes.

Monitoring Recommendations

Monitor contributor and author accounts for editing activity on pages that use News Kit widgets and correlate with subsequent visitor-side JavaScript errors or redirects.
Alert on Content Security Policy violation reports originating from pages that use the plugin.
Track plugin version inventory across managed WordPress sites and flag any host still running News Kit Addons For Elementor at or below 1.4.6.

How to Mitigate CVE-2026-11390

Immediate Actions Required

Update the News Kit Addons For Elementor plugin to version 1.4.7 or later, which contains the vendor fix.
Audit all pages built with the Site Logo Title and Single Author Box widgets and review stored tag_name values for injected markup.
Rotate credentials for administrator accounts that may have loaded compromised pages before patching.
Review contributor-level and higher user accounts and remove any that are unnecessary or unrecognized.

Patch Information

The vendor addressed the issue in version 1.4.7. See WordPress Changeset 3586039 for the code changes. The updated widget code enforces a server-side allowlist for the tag_name attribute. Compare the patched Site Logo Title code and the patched Single Author Box code against the vulnerable versions to confirm the fix in your environment.

Workarounds

Deactivate the News Kit Addons For Elementor plugin until the update is applied.
Restrict contributor-level and higher access to trusted users only, and require multi-factor authentication for all authors and editors.
Deploy a Content Security Policy that disallows inline scripts and untrusted event handlers to blunt the impact of injected payloads.
Add a WAF rule that rejects elementor_ajax requests whose tag_name field does not match a strict allowlist such as ^(h[1-6]|div|span|p)$.

bash

# Example WAF rule (ModSecurity) restricting elementor_ajax tag_name values
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026113900,\
    msg:'CVE-2026-11390 - Suspicious elementor_ajax tag_name value'"
  SecRule ARGS_POST:action "@streq elementor_ajax" \
    "chain"
    SecRule REQUEST_BODY "@rx \"tag_name\"\s*:\s*\"(?!h[1-6]|div|span|p)[^\"]*\"" \
      "t:none"