What’s Vulnerable › Vulnerabilities
CVE-2026-13393: ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)
- Severity: low (CVSS 3.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-31 · updated 2026-08-26
- Weakness: CWE-79
Description
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfiltered_html, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.
Affected products
- ElementsKit Elementor Addons: before 3.10.01 — fixed in 3.10.01
How to fix
Upgrade to a fixed version: ElementsKit Elementor Addons 3.10.01. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-13393 or the next vulnerability affects your stack