Stored Cross-Site Scripting Vulnerability in ElementsKit Pro Plugin for WordPress

CVE-2026-4246

What is CVE-2026-4246?

The ElementsKit Pro plugin for WordPress is prone to Stored Cross-Site Scripting vulnerabilities through the 's' parameter of the Advanced Search REST endpoint. This flaw results from inadequate input sanitization and improper output escaping, allowing unauthorized access to the REST endpoint. Unsanitized search terms are stored and later rendered in HTML attributes, creating opportunities for attackers to execute arbitrary scripts when users interact with the search widget. This can lead to serious security concerns for websites utilizing this plugin, as attackers can leverage these scripts to manipulate the user experience.

References