CVE-2026-6565: Style Kits for Elementor XSS Vulnerability

CVE-2026-6565 Overview

CVE-2026-6565 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress. The flaw exists in the /wp-json/agwp/v1/tokens/save REST endpoint, where the kit title parameter is processed without sufficient input sanitization and output escaping in an admin attribute context. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when any user views an affected page. The vulnerability is tracked under CWE-79 and impacts plugin versions up to and including 2.5.0.

Critical Impact
Authenticated contributors can store malicious scripts that execute in administrator browsers, enabling session theft, privilege escalation, and persistent site compromise.

Affected Products

Style Kits – Advanced Theme Styles for Elementor (WordPress plugin)
Versions up to and including 2.5.0
Sites running the analogwp-templates plugin slug

Discovery Timeline

2026-05-27 - CVE-2026-6565 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-6565

Vulnerability Analysis

The vulnerability resides in the Style Kits plugin's REST API handler that processes design token save requests. When a user submits a request to /wp-json/agwp/v1/tokens/save, the kit title parameter is stored in the WordPress database and later rendered into an HTML attribute within an administrative interface. The plugin fails to sanitize the input on receipt and does not escape the value when rendering it into the attribute context.

A contributor-level user can submit a payload that breaks out of the surrounding attribute and introduces event handlers or inline script. The injected content persists in the database and executes for every user who loads the affected page, including administrators. This produces a one-to-many attack pattern typical of stored XSS exploitation against WordPress sites.

Because the user interaction component is rated none, the script triggers automatically when the affected admin view loads. The scope change indicator reflects that an attacker operating with limited contributor privileges can affect resources controlled by higher-privileged users.

Root Cause

The root cause is missing input sanitization on the title parameter accepted by the tokens/save REST route, combined with absent output escaping at render time. WordPress provides sanitize_text_field() and esc_attr() for these contexts, but the vulnerable code path applies neither before persisting or echoing the value into an HTML attribute.

Attack Vector

An attacker authenticates to a target WordPress site using contributor credentials, which are commonly granted to guest writers and external contributors. The attacker issues an authenticated POST request to /wp-json/agwp/v1/tokens/save with a crafted kit title containing attribute-breaking syntax and JavaScript. When an administrator subsequently navigates to a page that renders the stored kit title, the payload executes in the administrator's browser session.

The vulnerability is described in prose only. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the corrective code diff.

Detection Methods for CVE-2026-6565

Indicators of Compromise

POST requests to /wp-json/agwp/v1/tokens/save originating from contributor or author accounts containing <script, onerror=, onload=, or javascript: substrings in the title field.
Unexpected modifications to Style Kits token records in the wp_options or wp_postmeta tables containing HTML or JavaScript syntax.
New or modified WordPress administrator accounts created shortly after a contributor session accessed plugin endpoints.

Detection Strategies

Inspect web server access logs for authenticated requests to the agwp/v1/tokens/save route and correlate the requesting user role against the request payload.
Run targeted database queries against Style Kits token storage to identify entries containing angle brackets, equals-quote pairs, or event handler attributes.
Apply web application firewall (WAF) signatures that match common XSS payload patterns against POST bodies sent to plugin REST endpoints.

Monitoring Recommendations

Alert on any contributor-level account interacting with administrative plugin REST routes, which is unusual for that role.
Monitor for outbound requests from administrator browsers to unfamiliar domains, which can indicate exfiltration via a triggered XSS payload.
Track plugin version inventory across WordPress sites and flag any host still running Style Kits 2.5.0 or earlier.

How to Mitigate CVE-2026-6565

Immediate Actions Required

Update the Style Kits plugin to a version above 2.5.0 that includes the fix from changeset 3530172.
Audit all contributor, author, and editor accounts and revoke access for users who do not require ongoing posting privileges.
Review existing Style Kits token records for stored payloads and remove or sanitize any entries containing HTML or script content.

Patch Information

The vendor addressed the issue in the WordPress Plugin Changeset for the analogwp-templates repository. The patch introduces proper sanitization on the kit title input and escapes the value when it is rendered into HTML attribute context. Administrators should apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

Restrict access to the affected REST route at the web server or WAF layer until the plugin can be updated.
Temporarily downgrade contributor accounts to subscriber level to remove the prerequisite privilege for exploitation.
Deactivate the Style Kits plugin on sites that cannot immediately apply the patched version.

bash

# Update the Style Kits plugin via WP-CLI
wp plugin update analogwp-templates

# Verify the installed version is above 2.5.0
wp plugin get analogwp-templates --field=version

# List contributor-level accounts for review
wp user list --role=contributor --fields=ID,user_login,user_email