CVE-2026-11390 blazethemes CVE debrief

Who should care

Users of News Kit Addons For Elementor plugin for WordPress, especially those with contributor-level access and above, should be aware of this vulnerability and take immediate action to protect their sites.

Technical summary

The vulnerability exists in the News Kit Addons For Elementor plugin for WordPress, specifically in the Site Logo Title and Single Author Box Widgets. The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts. These scripts can be executed when a user accesses an injected page. Exploitation requires an attacker to intercept and modify the elementor_ajax AJAX save request to bypass client-side SELECT control restrictions and submit arbitrary tag-name values.

Defensive priority

Medium priority due to the requirement for contributor-level access and the need for exploitation via AJAX request modification.

Recommended defensive actions

• Update News Kit Addons For Elementor plugin to a version beyond 1.4.6.
• Restrict contributor-level access and above to trusted users.
• Monitor for suspicious AJAX requests to elementor_ajax.
• Implement additional input validation and output encoding for Site Logo Title and Single Author Box Widgets.
• Perform regular security audits to identify potential vulnerabilities.
• Review and update access controls for WordPress installations.
• Track and verify updates to the News Kit Addons For Elementor plugin.

Evidence notes

Evidence from the NVD and Wordfence indicates a Stored Cross-Site Scripting vulnerability in News Kit Addons For Elementor plugin versions up to 1.4.6. The CVE record and NVD detail provide official confirmation of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.