CVE-2026-65488

HighCVSS 7.1

Published: 23/07/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio Element Kit for Elementor (lastudio-element-kit) allows Stored XSS. This issue affects versions from n/a through 1.6.2.

Risk Assessment

An attacker can exploit CSRF to execute a malicious script in the context of an administrator's browser, which can lead to session hijacking or content modification.

Recommendation

Update the LA-Studio Element Kit for Elementor plugin to the latest available version. Additionally, consider implementing CSRF protection mechanisms such as tokens.

Other vulnerabilities in LA-Studio Element Kit for Elementor

CVE-2026-65489Medium
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS