CVE-2026-65488: LA-Studio Element Kit for Elementor CSRF to Stored XSS

CVE-2026-65488 · Severity: high · CVSS 7.1 · Published 2026-07-23

LA-Studio Element Kit for Elementor is a WordPress plugin used to add custom widgets and features to the Elementor page builder. A security flaw allows an attacker to trick a site administrator into performing unintended actions, such as injecting malicious scripts into the website. This could lead to the unauthorized modification of site content or the compromise of visitor data.

Technologies: LA-Studio Element Kit for Elementor. Vendors: LA-Studio.

Quick answers

Is CVE-2026-65488 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-65488 being exploited in the wild.
How severe is CVE-2026-65488?
High severity, with a CVSS score of 7.1, published 23 July 2026.
Which products and versions are affected?
LA-Studio Element Kit for Elementor <= 1.6.2.
Is there a fix for CVE-2026-65488?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65488 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-65488?
Check whether you run LA-Studio Element Kit for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the LA-Studio Element Kit for Elementor plugin for WordPress (versions <= 1.6.2). The flaw stems from a lack of proper nonce validation, allowing an unauthenticated attacker to craft a malicious request that, if executed by a logged-in administrator, can lead to Stored Cross-Site Scripting (XSS). The attack requires the victim to interact with a malicious link or page. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session, potentially leading to site takeover. As of the advisory date, no official patch has been confirmed.

Affected products

  • LA-Studio LA-Studio Element Kit for Elementor <= 1.6.2

Timeline

  • 2026-02-04: disclosed: Reported by Steven Julian
  • 2026-07-22: advisory: Patchstack published advisory
  • 2026-07-23: advisory: NVD published CVE-2026-65488

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.