VULNERABILITY INTELLIGENCE

CVE-2026-97353

CVSS score5.4 MEDIUM

EPSS probability0.12%

CISA KEVNot currently listed

Published2026-10-24

Last modified2026-10-26

Description

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to …