Stored Cross-Site Scripting in Elementor Kits & Patterns Plugin for WordPress

CVE-2026-6565

What is CVE-2026-6565?

The Style Kits – Advanced Theme Styles for Elementor plugin suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output management. Specifically, this flaw is present in the '/wp-json/agwp/v1/tokens/save' endpoint, where unvalidated kit title parameters can be exploited by authenticated users with contributor-level access or higher. An attacker could inject malicious web scripts, leading to unauthorized script execution whenever the compromised page is accessed by any user.

References