6.5Mittel

CVE-2026-103063WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

Wpmet ElementsKit Elementor addons Lite Veröffentlicht: 2026-10-01 15:33 (vor 1 Monat)

Beschreibung

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6.

Schwachstellentyp (CWE): CWE-79

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
Wpmet	ElementsKit Elementor addons Lite	≤ 4.0.6

Referenzen und Patches

https://patchstack.com/database/wordpress/plugin/elementskit-lite/vulnerability/wordpress-elementskit-element… vdb-entry

CVSS-Score

6.5Mittel

Quelle: Patchstack · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Erforderlich
Geltungsbereich: Geändert
Vertraulichkeit: Niedrig
Integrität: Niedrig
Verfügbarkeit: Niedrig

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Alle Scores (2)

cna	CVSS 3.1	6.5Mittel
audit@patchstack.com	CVSS 3.1	6.5Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.13%

höher als 2 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2026-09-30
Veröffentlicht2026-10-01 15:33
Bei IP-DB eingegangen2026-10-24 23:43
Zuletzt aktualisiert2026-10-01 17:34

Vergeben von (CNA): Patchstack
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

Ohne Score

CVE-2026-124817 vor 1 Stunde

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

Ohne Score

CVE-2026-76792 vor 1 Stunde

User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

User Verification by PickPlugins

The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time-password login, and does not expire the generated code, allowing unauthenticated attackers to brute force it and log in as any user, …

Ohne Score

CVE-2026-124815 vor 1 Stunde

Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injectio…

Ohne Score

CVE-2026-124814 vor 1 Stunde

Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

Ultimate Addons for Elementor Forms

The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote …

Ohne Score

CVE-2026-124665 vor 1 Stunde

Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

Order Tracking

The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the …

Ohne Score

CVE-2026-124653 vor 1 Stunde

Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure

Mine CloudVod

The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site'…