CVE-2026-120524 in News Kit Addons for Elementor Plugin
Summary
by MITRE • 11/03/2026
The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because an operator-precedence bug in handle_scripts() causes the admin bundle — and its inlined nekit-admin-nonce — to be enqueued on every admin screen accessible to Subscribers (such as /wp-admin/profile.php), and because sanitize_text_field() is applied to the raw JSON string before json_decode(), allowing angle brackets encoded as \u003c/\u003e to survive sanitization and be restored to literal angle brackets, enabling overwrite of _elementor_data on any post.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The News Kit Addons For Elementor plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 1.4.8. This flaw manifests as a Stored Cross-Site Scripting (XSS) issue, which allows authenticated attackers with subscriber-level access or higher to inject malicious web scripts into pages within the application environment. The primary vector for this exploitation is the formData parameter, where insufficient input sanitization and output escaping mechanisms fail to neutralize potentially dangerous content before it is stored in the database. Consequently, when other users subsequently view these compromised pages, the injected scripts execute automatically in their browsers, leading to unauthorized actions or data theft under the context of the victim user account.
The technical root cause of this vulnerability lies in a specific operator-precedence bug within the handle_scripts() function. This logic error results in the admin bundle and its associated inline nonce being enqueued on every administrative screen accessible to users with subscriber privileges, such as the profile editing page at /wp-admin/profile.php. By ensuring that necessary JavaScript execution contexts are available even for low-privilege areas of the administration panel, the vulnerability expands the attack surface significantly. This architectural oversight allows attackers who might otherwise be restricted in their capabilities to leverage standard administrative interfaces for malicious script injection and subsequent execution.
The exploitation mechanism relies on a flaw in how data is processed before storage. Specifically, the sanitize_text_field() function is applied to the raw JSON string prior to its decoding via json_decode(). This sequence creates a dangerous loophole because angle brackets encoded as \u003c/\u003e survive the sanitization process intact. When the subsequent json_decode operation occurs, these entities are restored into literal less-than and greater-than characters (< >). These unescaped literals can then be used to overwrite the _elementor_data field on any post or page managed by the plugin. This overwriting capability is particularly severe as it allows attackers to inject arbitrary HTML and JavaScript directly into the content structure of web pages, bypassing standard security filters that typically rely on entity encoding for protection against XSS attacks.
From an operational perspective, this vulnerability poses a significant risk to website integrity and user safety. Because the attack requires only subscriber-level access, which is often granted broadly in WordPress installations for contributors or authors, the barrier to entry for attackers is low. Once executed, the stored script can perform various malicious actions depending on its payload, including stealing session cookies, performing administrative actions on behalf of the victim, defacing content, or redirecting users to phishing sites. The persistence of this data means that every user accessing the affected page becomes a potential target until the vulnerability is patched and the compromised entries are cleaned from the database.
To mitigate this risk, immediate action should be taken by upgrading the News Kit Addons For Elementor plugin to version 1.4.9 or later, where these issues have been addressed. In addition to updating software, administrators should review user roles and ensure that only trusted individuals hold subscriber-level access with write permissions. Implementing a Web Application Firewall can also provide an additional layer of defense by filtering out malicious payloads before they reach the application logic. Furthermore, regular security audits focusing on input sanitization and output escaping practices are recommended to prevent similar vulnerabilities in custom code or other plugins.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector corresponds to ATT&CK technique T1059, specifically the execution of JavaScript within a browser context via stored payloads. Understanding these classifications helps in mapping the threat landscape and applying appropriate defensive controls consistent with industry standards for web application security.