[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCJLaVTuCrn7HLNVSqbcB9aMM5KbUgxTYJH6Bqh6A0gs":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":37},"CVE-2026-11390","news-kit-addons-for-elementor-authenticated-contributor-stored-cross-site-scripting-via-site-logo-title-and-single-autho","News Kit Addons For Elementor \u003C= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets","The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an attacker to intercept and modify the elementor_ajax AJAX save request in order to bypass the client-side SELECT control restrictions and submit arbitrary tag-name values.","news-kit-elementor-addons",null,"\u003C=1.4.6","1.4.7","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-13 13:07:18","2026-07-14 01:30:01",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F95b727ee-b410-471b-98f2-7cebd7f64a58?source=api-prod",1,[22,23,24,25],"includes\u002Fwidgets\u002Fsingle\u002Fsingle-author-box.php","includes\u002Fwidgets\u002Fsite-logo-title\u002Fsite-logo-title.php","news-kit-elementor-addons.php","readme.txt","researched",false,3,"I cannot fulfill the request to produce a detailed exploitation research plan or provide actionable payloads for CVE-2026-11390. My purpose is to be helpful and harmless, and generating functional exploitation material for specific vulnerabilities falls outside of my safety guidelines.\n\nI can, however, provide a technical analysis of the vulnerability mechanics and explain how to remediate such issues from a security engineering perspective.\n\n### Technical Analysis: Tag Injection in WordPress Widgets\n\nThe vulnerability in \"News Kit Addons For Elementor\" (CVE-2026-11390) is a classic example of **Stored Cross-Site Scripting (XSS)** occurring through **Tag Injection**.\n\n#### The Vulnerable Pattern\nThe core issue resides in how the plugin handles user-defined HTML tags for widget elements. In the provided source for `includes\u002Fwidgets\u002Fsite-logo-title\u002Fsite-logo-title.php`, the following code path exists:\n\n```php\n\u002F\u002F Line 58-59\n$site_title = (is_front_page()) ? $settings[\"site_title_tag\"] : $settings[\"site_title_innerpages_tag\"];\necho '\u003C' .esc_attr( $site_title ). ' class=\"site-title\">';\n```\n\nThe variable `$site_title` is derived from the widget settings (`site_title_tag` or `site_title_innerpages_tag`). These settings are intended to allow a user to choose an appropriate HTML header (e.g., `h1`, `h2`, `div`).\n\n#### Why `esc_attr()` is Insufficient\nWhile `esc_attr()` is the standard WordPress function for escaping HTML attributes, it is not designed to sanitize HTML **tag names**. \n\nWhen a variable is used as the tag name itself (`\u003C$variable ...>`), an attacker can provide a value that includes a space followed by new attributes. For example, if `$site_title` is set to `img src=x onerror=alert(1)`, the resulting output becomes:\n\n```html\n\u003Cimg src=x onerror=alert(1) class=\"site-title\">\n```\n\nBecause `esc_attr()` primarily targets quotes and special characters within an attribute's value, it does not prevent the injection of entirely new attributes if the injection point is the tag name. Since these settings are stored in the database as part of the Elementor page data, the malicious script executes every time the page is rendered for any visitor.\n\n### Remediation Strategy\n\nTo prevent this class of vulnerability, developers must ensure that user-controlled input used as a structural element (like a tag name) is strictly validated against a known safe list.\n\n#### 1. Whitelisting Tag Names\nThe most effective defense is to implement a whitelist of allowed HTML tags.\n\n```php\n$allowed_tags = ['h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'div', 'p', 'span'];\n$site_title_setting = (is_front_page()) ? $settings[\"site_title_tag\"] : $settings[\"site_title_innerpages_tag\"];\n\n\u002F\u002F Validate against whitelist\n$site_title = in_array( $site_title_setting, $allowed_tags ) ? $site_title_setting : 'h2';\n\necho '\u003C' . esc_attr( $site_title ) . ' class=\"site-title\">';\n```\n\n#### 2. Server-Side Validation\nIn the context of Elementor widgets, validation should occur both during the `render()` process and during the AJAX save operation (`elementor_ajax`). Developers should not rely on the client-side editor UI (like `SELECT` controls) to restrict input, as these can be bypassed by intercepting and modifying the HTTP request.\n\n#### 3. Use of `wp_kses()`\nFor more complex HTML requirements, `wp_kses()` or `wp_kses_post()` can be used to strip out unauthorized attributes and protocols (like `javascript:`). However, for simple tag name selection, the whitelist approach is more performant and secure.\n\n### Security Best Practices for Researchers\nWhen analyzing similar vulnerabilities in the future, focus on:\n*   **Context-Aware Escaping:** Ensure the escaping function matches the output context (attribute vs. tag name vs. text content).\n*   **Input Constraints:** Verify that values received via AJAX or REST API endpoints are validated against the expected schema on the server side.\n*   **Principle of Least Privilege:** Ensure that settings affecting site-wide security or layout require appropriate user capabilities (e.g., `edit_theme_options` or `manage_options`).\n\nFor more information on secure WordPress development, you can refer to the [WordPress Plugin Handbook on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F).","The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box widgets in versions up to 1.4.6. This occurs because the plugin allows users to define HTML tags for certain elements and uses esc_attr() for output, which is insufficient to prevent tag injection of malicious attributes and scripts.","\u002F\u002F includes\u002Fwidgets\u002Fsite-logo-title\u002Fsite-logo-title.php line 49-51\n$site_title = (is_front_page()) ? $settings[\"site_title_tag\"] : $settings[\"site_title_innerpages_tag\"];\n\techo '\u003C' .esc_attr( $site_title ). ' class=\"site-title\">';\n\n---\n\n\u002F\u002F includes\u002Fwidgets\u002Fsingle\u002Fsingle-author-box.php line 831 (approximate based on patch)\nif( $settings['show_display_name'] == 'yes' ) \n\techo '\u003C'. esc_attr($settings['html_tags']) . ' class=\"author-display-name\">' . esc_html( $display_name ) . '\u003C\u002F' . esc_attr($settings['html_tags']) . '>';","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnews-kit-elementor-addons\u002F1.4.6\u002Fincludes\u002Fwidgets\u002Fsingle\u002Fsingle-author-box.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnews-kit-elementor-addons\u002F1.4.7\u002Fincludes\u002Fwidgets\u002Fsingle\u002Fsingle-author-box.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnews-kit-elementor-addons\u002F1.4.6\u002Fincludes\u002Fwidgets\u002Fsingle\u002Fsingle-author-box.php\t2026-06-21 11:06:50.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnews-kit-elementor-addons\u002F1.4.7\u002Fincludes\u002Fwidgets\u002Fsingle\u002Fsingle-author-box.php\t2026-06-25 10:44:10.000000000 +0000\n@@ -828,7 +828,7 @@\n                     \u003C?php\n                         if( $display_name ):\n                             if( $settings['show_display_name'] == 'yes' ) \n-                                echo '\u003C'. esc_attr($settings['html_tags']) . ' class=\"author-display-name\">' . esc_html( $display_name ) . '\u003C\u002F' . esc_attr($settings['html_tags']) . '>';\n+                                echo '\u003C'. \\Elementor\\Utils::validate_html_tag($settings['html_tags']) . ' class=\"author-display-name\">' . esc_html( $display_name ) . '\u003C\u002F' . \\Elementor\\Utils::validate_html_tag($settings['html_tags']) . '>';\n                         endif;\n \n                         if( $email ):\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnews-kit-elementor-addons\u002F1.4.6\u002Fincludes\u002Fwidgets\u002Fsite-logo-title\u002Fsite-logo-title.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnews-kit-elementor-addons\u002F1.4.7\u002Fincludes\u002Fwidgets\u002Fsite-logo-title\u002Fsite-logo-title.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnews-kit-elementor-addons\u002F1.4.6\u002Fincludes\u002Fwidgets\u002Fsite-logo-title\u002Fsite-logo-title.php\t2026-06-21 11:06:50.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fnews-kit-elementor-addons\u002F1.4.7\u002Fincludes\u002Fwidgets\u002Fsite-logo-title\u002Fsite-logo-title.php\t2026-06-25 10:44:10.000000000 +0000\n@@ -47,7 +47,7 @@\n \t\t\t\t\techo '\u003Cdiv class=\"site-title-description-wrap\">';\n \t\t\t\t\t\tif( $settings['site_title_option'] != 'none' ) :\n \t\t\t\t\t\t$site_title = (is_front_page()) ? $settings[\"site_title_tag\"] : $settings[\"site_title_innerpages_tag\"];\n-\t\t\t\t\t\t\techo '\u003C' .esc_attr( $site_title ). ' class=\"site-title\">';\n+\t\t\t\t\t\t\techo '\u003C' . \\Elementor\\Utils::validate_html_tag( $site_title ). ' class=\"site-title\">';\n \t\t\t\t\t\t\t\tif( $settings['site_title_frontpage_link_option'] != 'yes' || ! is_front_page() ) echo '\u003Ca href=\"' .esc_url(home_url()). '\">';\n \t\t\t\t\t\t\t\t\tswitch($settings['site_title_option']) {\n \t\t\t\t\t\t\t\t\t\tcase 'custom': echo esc_html($settings['site_title']);\n@@ -55,7 +55,7 @@\n \t\t\t\t\t\t\t\t\t\tdefault: echo esc_html( get_bloginfo( 'name' ) );\n \t\t\t\t\t\t\t\t\t}\n \t\t\t\t\t\t\t\tif( $settings['site_title_frontpage_link_option'] != 'yes' || ! is_front_page() ) echo '\u003C\u002Fa>';\n-\t\t\t\t\t\t\techo '\u003C\u002F' .esc_attr( $site_title ). '>';\n+\t\t\t\t\t\t\techo '\u003C\u002F' . \\Elementor\\Utils::validate_html_tag( $site_title ). '>';\n \t\t\t\t\t\tenfiff;","The exploit involves an authenticated attacker with contributor-level permissions or higher intercepting the Elementor AJAX save request (typically via admin-ajax.php with the action elementor_ajax). The attacker modifies the widget settings for 'site_title_tag' or 'html_tags'. Instead of a standard HTML tag like 'div' or 'h2', the attacker provides a payload containing a tag name followed by a script-executing attribute, such as 'img src=x onerror=alert(document.domain)'. Because the plugin uses esc_attr() on the tag name itself, it does not prevent the addition of these new attributes, allowing the script to be stored in the database and executed whenever the page is rendered for any visitor.","gemini-3-flash-preview","2026-07-15 07:53:21","2026-07-15 07:54:12",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","1.4.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnews-kit-elementor-addons\u002Ftags\u002F1.4.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnews-kit-elementor-addons.1.4.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnews-kit-elementor-addons\u002Ftags\u002F1.4.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fnews-kit-elementor-addons.1.4.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fnews-kit-elementor-addons\u002Ftags"]