CVE-2026-120524 Details
Description
The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because an operator-precedence bug in handle_scripts() causes the admin bundle — and its inlined nekit-admin-nonce — to be enqueued on every admin screen accessible to Subscribers (such as /wp-admin/profile.php), and because sanitize_text_field() is applied to the raw JSON string before json_decode(), allowing angle brackets encoded as \u003c/\u003e to survive sanitization and be restored to literal angle brackets, enabling overwrite of _elementor_data on any post.
A stored cross-site scripting vulnerability has been identified in the News Kit Addons For Elementor plugin for WordPress, affecting all versions through 1.4.8. The issue arises from inadequate input sanitization and output escaping, allowing authenticated attackers with subscriber-level access and above to inject arbitrary scripts into pages. These scripts execute when a user accesses the affected page. The vulnerability is facilitated by an operator-precedence bug in the handle_scripts() function, which improperly enqueues the admin bundle and its nonce on admin screens available to subscribers. Additionally, the use of sanitize_text_field() on the raw JSON before decoding it with json_decode() permits angle brackets encoded as \u003c/\u003e to bypass sanitization, enabling the injection of scripts via the formData parameter and overwriting of _elementor_data on any post.
Users are advised to update the News Kit Addons For Elementor plugin to version 1.4.9 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| News Kit Addons | <= 1.4.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |