CVE-2026-13393 Overview
CVE-2026-13393 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the ElementsKit Elementor Addons WordPress plugin in versions before 3.10.01. The plugin fails to sanitize or escape megamenu menu-item settings before storing and rendering them on the front end. It also does not enforce the unfiltered_html capability check when saving these settings. On WordPress multisite networks, a subsite Administrator without unfiltered_html privileges can plant a persistent JavaScript payload that executes in the browser sessions of the network Super Admin and site visitors.
Critical Impact
A subsite Administrator on a multisite deployment can store JavaScript that runs in the Super Admin's authenticated session, enabling account takeover of the network.
Affected Products
- ElementsKit Elementor Addons WordPress plugin versions before 3.10.01
- WordPress multisite deployments running vulnerable plugin versions
- WordPress single-site installations where lower-privileged Administrators exist
Discovery Timeline
- 2026-07-31 - CVE-2026-13393 published to NVD
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-13393
Vulnerability Analysis
The vulnerability resides in the megamenu feature of the ElementsKit Elementor Addons plugin. The plugin accepts menu-item settings from authenticated users with administrative capabilities and stores them without applying output escaping such as esc_html(), esc_attr(), or wp_kses(). When the front end renders the megamenu, the stored values are emitted directly into the HTML document. Any JavaScript included in those settings executes in the browser context of every viewer.
The issue is compounded by a missing capability check. WordPress reserves the unfiltered_html capability for trusted roles that may submit raw HTML and script content. On multisite installations, this capability is stripped from subsite Administrators and reserved for the network Super Admin. The plugin ignores this boundary and permits any user with administrative access to save unfiltered menu-item content.
Root Cause
The root cause is twofold: absent input sanitization and output escaping around megamenu menu-item settings, and a missing current_user_can('unfiltered_html') check on the save handler. Together these gaps let a subsite Administrator bypass the multisite trust model.
Attack Vector
An authenticated attacker with Administrator capabilities on a subsite navigates to the megamenu configuration for an ElementsKit menu item and injects a JavaScript payload into a vulnerable setting field. The payload is written to the database and rendered whenever the menu is displayed. When the network Super Admin browses the affected site or its dashboard preview, the script executes with Super Admin session cookies available, enabling privilege escalation across the entire multisite network. Site visitors are also exposed to the payload during normal browsing.
See the WPScan Vulnerability Overview for additional technical details.
Detection Methods for CVE-2026-13393
Indicators of Compromise
- Unexpected <script> tags, on* event handlers, or javascript: URIs inside stored megamenu configuration in the wp_postmeta or wp_options tables.
- Outbound requests from visitor browsers to unfamiliar domains immediately after loading pages that render an ElementsKit megamenu.
- Recent edits to megamenu items by subsite Administrator accounts on multisite installations where the Super Admin did not authorize the change.
Detection Strategies
- Audit the ElementsKit plugin version across all WordPress sites and flag any deployment running a version earlier than 3.10.01.
- Search stored megamenu settings for HTML control characters such as <, >, and encoded equivalents that should not appear in menu labels or link attributes.
- Correlate Administrator logins with subsequent megamenu save events and Super Admin dashboard sessions to detect potential exploitation chains.
Monitoring Recommendations
- Enable WordPress audit logging to record plugin setting changes with user, timestamp, and diff data.
- Deploy a web application firewall rule that inspects requests to ElementsKit AJAX and REST endpoints for script payloads.
- Monitor Content Security Policy (CSP) violation reports for inline script executions originating from menu components.
How to Mitigate CVE-2026-13393
Immediate Actions Required
- Update ElementsKit Elementor Addons to version 3.10.01 or later on all WordPress sites.
- Review existing megamenu configurations for injected scripts and remove any unauthorized content before restoring service.
- Rotate authentication cookies and passwords for Super Admin and Administrator accounts on multisite networks that ran the vulnerable version.
Patch Information
The vendor addressed the vulnerability in ElementsKit Elementor Addons version 3.10.01 by adding sanitization and enforcing the unfiltered_html capability check on megamenu setting persistence. Refer to the WPScan Vulnerability Overview for advisory details.
Workarounds
- Restrict Administrator role assignment on multisite subsites to trusted operators until the plugin is upgraded.
- Temporarily disable the ElementsKit megamenu module if the plugin cannot be updated immediately.
- Apply a Content Security Policy that blocks inline scripts on front-end pages to limit payload execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
