CVE-2026-13393
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing and outputting them, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript. On a multisite network, this lets a non-super subsite Administrator plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.
Risk Assessment
An attacker can steal administrator and visitor sessions, take over accounts, or spread malware on the site.
Recommendation
Update the ElementsKit Elementor Addons plugin to version 3.10.01 or later.
Original NVD description (English source)
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfiltered_html, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.