Stored Cross-Site Scripting Vulnerability in News Kit Addons For Elementor Plugin

CVE-2026-120524

What is CVE-2026-120524?

The News Kit Addons For Elementor plugin allows attackers with subscriber-level access and above to exploit a vulnerability that permits the injection of arbitrary web scripts into pages. This happens through the 'formData' parameter across all versions up to and including 1.4.8. The underlying issue stems from inadequate input sanitization and output escaping, enabling the execution of malicious scripts whenever an affected page is accessed. A flaw in the operator precedence of the handle_scripts() function leads to an administrative bundle and inlined nonce being accessible on every admin screen, which poses a significant security risk as it permits manipulation of _elementor_data on posts. Additionally, flaws in sanitization processes allow encoded angle brackets to bypass security measures, facilitating further exploitation.

References