CVE-2026-4246: ElementsKit Pro WordPress XSS Vulnerability

CVE-2026-4246 Overview

CVE-2026-4246 is a Stored Cross-Site Scripting (XSS) vulnerability in the ElementsKit Pro plugin for WordPress. All versions up to and including 4.10.1 are affected. The flaw resides in the s parameter of the Advanced Search REST endpoint at /wp-json/elementskit/v1/advanced-search. The endpoint sets permission_callback to __return_true, permitting unauthenticated access. Search terms are persisted to the ekit_advanced_search_popular_keyword WordPress option and later rendered inside HTML attributes without proper escaping, allowing attackers to inject scripts that execute in visitors' browsers [CWE-79].

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that runs whenever users trigger the "no results" popular keywords view on pages using the Advanced Search widget.

Affected Products

ElementsKit Pro plugin for WordPress — all versions through 4.10.1
WordPress sites using the Advanced Search widget from ElementsKit Pro
Pages exposing the /wp-json/elementskit/v1/advanced-search REST route

Discovery Timeline

2026-08-28 - CVE-2026-4246 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-4246

Vulnerability Analysis

The ElementsKit Pro Advanced Search widget exposes a REST endpoint that accepts a search query via the s parameter. Because permission_callback is set to __return_true, any unauthenticated client can invoke the endpoint. Submitted search terms are written to the ekit_advanced_search_popular_keyword option through update_option(). When a subsequent visitor performs a search returning zero results, the stored keywords are rendered as "popular keywords" inside HTML attributes.

Root Cause

The plugin applies sanitize_text_field() to the incoming search term. That function strips tags and control characters but does not encode double quotes. The stored value is later interpolated into an HTML attribute using sprintf without a call to esc_attr(). A double-quote character in the stored keyword closes the attribute early and allows attribute injection, including onerror, onclick, or onmouseover event handlers that execute arbitrary JavaScript in the victim's browser context.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to /wp-json/elementskit/v1/advanced-search with a payload in the s parameter that breaks out of the attribute quoting and appends an event handler. The malicious keyword is written to the WordPress options table. Any site visitor who triggers the "no results" popular keywords view on a page using the Advanced Search widget will render the payload and execute the injected script. Because the payload is stored, exploitation persists until the option is cleared or the plugin is patched. Consult the Wordfence Vulnerability Report and the WordPress ElementsKit Search Handler source for the vulnerable code paths.

Detection Methods for CVE-2026-4246

Indicators of Compromise

Unauthenticated POST or GET requests to /wp-json/elementskit/v1/advanced-search containing double quotes, angle brackets, or JavaScript event handler names in the s parameter.
Unexpected content in the ekit_advanced_search_popular_keyword WordPress option containing ", on*=, or javascript: fragments.
Outbound requests from browsers rendering site pages to unfamiliar attacker-controlled domains after visiting search pages.

Detection Strategies

Inspect WordPress options with SQL: SELECT option_value FROM wp_options WHERE option_name = 'ekit_advanced_search_popular_keyword'; and flag any HTML-significant characters.
Deploy WAF rules that match XSS patterns in the s query parameter targeting the ElementsKit REST route.
Review web server access logs for anomalous request volume against /wp-json/elementskit/v1/advanced-search from single IPs.

Monitoring Recommendations

Alert on new or modified rows in wp_options associated with the ElementsKit search keyword option.
Monitor Content Security Policy (CSP) violation reports for inline script or event handler blocks on search pages.
Track user-reported browser warnings or unexpected redirects from pages hosting the Advanced Search widget.

How to Mitigate CVE-2026-4246

Immediate Actions Required

Update ElementsKit Pro to a version later than 4.10.1 as soon as the vendor releases a fixed build. Confirm via the WP Met ElementsKit Roadmap.
Clear the ekit_advanced_search_popular_keyword option to remove any stored payloads: wp option delete ekit_advanced_search_popular_keyword.
Audit all pages using the Advanced Search widget and review recent REST traffic to the affected endpoint.

Patch Information

At the time of publication, the NVD entry lists all versions up to and including 4.10.1 as vulnerable. Refer to the Wordfence Vulnerability Report and the WP Met ElementsKit Overview for the latest fixed version once released.

Workarounds

Temporarily disable the Advanced Search widget on public pages until a patched version is installed.
Block or require authentication on /wp-json/elementskit/v1/advanced-search at the web server or WAF layer.
Enforce a strict Content Security Policy that disallows inline event handlers to reduce impact of attribute injection.

bash

# Example NGINX rule to block unauthenticated access to the vulnerable REST route
location ~ ^/wp-json/elementskit/v1/advanced-search {
    deny all;
    return 403;
}