CVE-2026-94500: ElementsKit Elementor XSS Vulnerability

CVE-2026-94500 Overview

CVE-2026-94500 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the ElementsKit Elementor addons Lite WordPress plugin in versions up to and including 4.0.5. Authenticated users with Contributor-level privileges can inject malicious script payloads that execute in the browsers of other users who view the affected content. The flaw carries a medium severity rating and can be exploited over the network with low complexity, requiring user interaction to trigger the payload. Successful exploitation may allow attackers to hijack sessions, steal authentication tokens, or perform actions in the context of higher-privileged users such as editors or administrators.

Critical Impact
A Contributor-level account can inject stored or reflected JavaScript that executes when privileged users view plugin-rendered content, enabling session theft and privilege escalation paths within WordPress sites using ElementsKit Elementor addons Lite <= 4.0.5.

Affected Products

ElementsKit Elementor addons Lite plugin for WordPress
All versions up to and including 4.0.5
WordPress sites permitting Contributor-role registrations with the plugin active

Discovery Timeline

2026-09-23 - CVE-2026-94500 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94500

Vulnerability Analysis

The vulnerability resides in how the ElementsKit Elementor addons Lite plugin processes user-supplied input from Contributor-role accounts. Input fields exposed to Contributors are not properly sanitized or output-encoded before being rendered in the browser. When a Contributor submits crafted content containing HTML or JavaScript, the payload persists and later executes in the context of any user who views the affected page or preview.

The attack surface requires an authenticated session at the Contributor role or higher. Contributors can typically create draft posts and use plugin-provided widgets, which is where the tainted input path exists. Because the executed script runs under the origin of the WordPress site, an attacker can access cookies, invoke privileged REST endpoints, and modify content on behalf of an editor or administrator who previews the malicious draft.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin fails to apply WordPress sanitization functions such as wp_kses_post() on input and esc_html() or esc_attr() on output for fields accessible to Contributor-role users. Trust boundaries between the Contributor role and higher-privileged reviewers are not enforced within the plugin's widget rendering logic.

Attack Vector

An attacker first obtains or registers a Contributor account on a target WordPress site running a vulnerable version of ElementsKit Elementor addons Lite. The attacker then creates content using an affected plugin widget, embedding a JavaScript payload within a vulnerable field. When an administrator or editor previews or reviews the draft, the browser executes the injected script under the site's origin. The scope-changed nature of the flaw allows the attacker's payload to impact users beyond the attacker's own privilege boundary. Refer to the Patchstack Advisory on XSS Vulnerability for additional technical context.

Detection Methods for CVE-2026-94500

Indicators of Compromise

Draft or published posts created by Contributor accounts that contain <script> tags, on* event handlers, or javascript: URIs within ElementsKit widget content
Unexpected outbound HTTP requests originating from administrator browser sessions immediately after previewing Contributor content
New administrator accounts, altered user roles, or modified plugin/theme files following Contributor content review
Session cookies observed being transmitted to external hosts in browser telemetry or web proxy logs

Detection Strategies

Inventory all WordPress installations and identify sites running ElementsKit Elementor addons Lite at version 4.0.5 or earlier
Audit wp_posts content for suspicious HTML patterns in posts authored by Contributor-role users
Correlate WordPress audit logs with administrator preview activity to identify suspicious sequences of Contributor submission followed by admin review
Review web server access logs for unusual REST API calls made shortly after admin previews of Contributor drafts

Monitoring Recommendations

Enable a WordPress security audit plugin to record role changes, plugin installations, and content edits by privileged users
Deploy Content Security Policy (CSP) headers restricting inline script execution and log CSP violation reports
Monitor for creation of new administrator accounts or elevation of Contributor accounts to Editor or Administrator
Track file integrity of WordPress core, plugin, and theme directories to detect post-exploitation modifications

How to Mitigate CVE-2026-94500

Immediate Actions Required

Update ElementsKit Elementor addons Lite to a version later than 4.0.5 as soon as a fixed release is available from the vendor
Review all Contributor-role accounts and remove any that are not required for site operation
Audit recent Contributor-submitted drafts for embedded scripts before allowing administrators to preview them
Rotate administrator session cookies and passwords if any evidence of exploitation is identified

Patch Information

Refer to the Patchstack Advisory on XSS Vulnerability for the current patch status and remediation guidance. Apply the vendor-supplied update through the WordPress plugin management interface once available, and verify the installed version after upgrade.

Workarounds

Temporarily disable the ElementsKit Elementor addons Lite plugin until a patched version is installed
Restrict new user registrations and revoke Contributor privileges from untrusted accounts
Deploy a web application firewall (WAF) rule to block requests containing script tags or event handler attributes in plugin form fields
Enforce a strict Content Security Policy that disallows inline JavaScript execution on WordPress admin pages

bash

# Configuration example: enforce a restrictive Content Security Policy in Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"

# Disable new user registrations via WP-CLI
wp option update users_can_register 0

# List and audit Contributor accounts
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered