Executive brief
ElementsKit is a popular WordPress plugin used to add advanced features like "megamenus" to websites. A security flaw allows a sub-site administrator on a multi-site network to inject malicious code into the website's menu settings. This code can then target and take control of the sessions of high-level network administrators or steal information from site visitors.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the ElementsKit Elementor Addons plugin for WordPress (versions prior to 3.10.01). The plugin fails to sanitize or escape megamenu menu-item settings, such as 'menu_badge_text', before storing them in the database and rendering them on the front end. While WordPress administrators typically have 'unfiltered_html' capabilities, in a multisite environment, subsite administrators are restricted from using HTML. This vulnerability allows a subsite administrator to bypass these restrictions and plant a malicious payload. The payload executes when the menu is viewed by other users, including network Super Admins, potentially leading to privilege escalation or session hijacking. The issue is fixed in version 3.10.01.
Affected products
- WPMet ElementsKit Elementor Addons (Lite) < 3.10.01
Timeline
- 2026-07-14: disclosed: Initial public disclosure by WPScan
- 2026-07-14: patched: Fixed in version 3.10.01
- 2026-07-31: advisory: NVD publication date