# CVE-2026-65482: LA-Studio Element Kit for Elementor Contributor XSS

Source: https://junglewise.ai/threats/cve-2026-65482-la-studio-element-kit-for-elementor-contributor-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-65482 · Severity: medium · CVSS 6.5 · Published 2026-07-23

LA-Studio Element Kit for Elementor is a WordPress plugin used to add custom widgets and design elements to websites. A security vulnerability allows users with 'Contributor' level access to inject malicious scripts into web pages. If a site administrator or visitor views the affected content, these scripts could lead to unauthorized actions, data theft, or website defacement.

Technologies: [LA-Studio Element Kit for Elementor](https://junglewise.ai/threats/technologies/element-kit-for-elementor). Vendors: [LA-Studio](https://junglewise.ai/threats/vendors/la-studio).

## Quick answers

**Is CVE-2026-65482 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65482 being exploited in the wild.

**How severe is CVE-2026-65482?** Medium severity, with a CVSS score of 6.5, published 23 July 2026.

**Which products and versions are affected?** LA-Studio Element Kit for Elementor <= 1.6.2.

**Is there a fix for CVE-2026-65482?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65482 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-65482?** Check whether you run LA-Studio Element Kit for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the LA-Studio Element Kit for Elementor plugin for WordPress (versions up to and including 1.6.2). The flaw stems from improper neutralization of user-supplied input during web page generation (CWE-79). An attacker with Contributor-level privileges can inject malicious JavaScript into plugin-managed components. This script executes in the context of a victim's browser when they visit the affected page, requiring some user interaction. As of the advisory date, no official patch has been released.

## Affected products

- LA-Studio LA-Studio Element Kit for Elementor <= 1.6.2

## Timeline

- 2026-01-30: disclosed: Reported by Abu Hurayra via Patchstack
- 2026-07-23: advisory: NVD publication date

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [LA-Studio Element Kit for Elementor server-side request forgery](https://junglewise.ai/threats/cve-2026-103082-server-side-request-forgery-ssrf-vulnerability-in-la-studio-la)
- [LA-Studio Element Kit for Elementor broken access control](https://junglewise.ai/threats/cve-2026-65489-la-studio-element-kit-for-elementor-broken-access-control)
- [LA-Studio Element Kit for Elementor CSRF to Stored XSS](https://junglewise.ai/threats/cve-2026-65488-la-studio-element-kit-for-elementor-csrf-to-stored-xss)
- [LA-Studio Element Kit for Elementor unauthenticated account registration](https://junglewise.ai/threats/cve-2026-12276-la-studio-element-kit-for-elementor-unauthenticated-account)