sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total7
Critical0
High1
Medium6
Reset
Showing 1-7 of 7 records
Threat Entry Updated 2026-11-03

News Kit Elementor Addons - Security Vulnerability (CVE-2026-120524)

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because an operator-precedence bug in handle_scripts() causes the admin bundle — and its inlined nekit-admin-nonce — to be enqueued on every admin screen…

PLUGIN News Kit Elementor Addons

CVE-2026-120524

MEDIUM CVSS 6.4 2026-11-03
Open Full Technical Breakdown
Threat Entry Updated 2026-07-14

News Kit Elementor Addons - Cross-Site Scripting (XSS) (CVE-2026-11390)

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an attacker to intercept and modify the elementor_ajax AJAX save request in order to bypass the client-side SELECT control…

PLUGIN News Kit Elementor Addons

CVE-2026-11390

MEDIUM CVSS 6.4 2026-07-14
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

News Kit Elementor Addons - Information Disclosure (CVE-2024-9541)

The News Kit Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.1 via the render function in includes/widgets/canvas-menu/canvas-menu.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft Elementor template data.

PLUGIN News Kit Elementor Addons

CVE-2024-9541

MEDIUM CVSS 4.3 2024-10-22
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.