CVE-2026-11390

News Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets

The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an attacker to intercept and modify the elementor_ajax AJAX save request in order to bypass the client-side SELECT control restrictions and submit arbitrary tag-name values.

We have discovered 442 live websites that are affected by CVE-2026-11390.

Run a Free Instant Scan



Affected Software

Product  News Kit Elementor Addons
Category Wordpress Plugins
Vulnerable Domains442 live websites (99% of News Kit Elementor Addons install base)
Vulnerable Versions
  • from 0 through 1.4.6
Vulnerable Versions Count1 versions ( 50% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 14, 2026
  • Updated - Jul 14, 2026

Credits

  • Romain Deperne (ang3L) (finder)

Website Distribution by Country

Number of websites using CVE-2026-11390
United States131 websites


Cyprus57 websites
Germany38 websites
Poland27 websites
France15 websites
Indonesia15 websites
GB14 websites
India14 websites
Singapore10 websites
Argentina8 websites

Website Distribution by TLD

Number of websites using CVE-2026-11390
.com246 websites
.org15 websites
.pl15 websites
.net12 websites
.de7 websites
.it6 websites
.info6 websites
.ru6 websites
.nl6 websites
.com.br5 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-11390

Top websites that are affected by CVE-2026-11390. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**********.com United States***,***
********.com United States***,***
***********.com United States***,***
*******.de Germany***,***
****.hu Hungary***,***
*************.pl Poland***,***
*************.com Cyprus***,***
***********.nl Netherlands***,***
*****.fr France*,***,***
*************.com France*,***,***
See full domain list

FAQ

CVE-2026-11390 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in News Kit Elementor Addons
A total of 442 websites have been identified as vulnerable to CVE-2026-11390, based on global website indexing conducted by WebTechSurvey.
The News Kit Elementor Addons is affected by the CVE-2026-11390 vulnerability.
News Kit Elementor Addons versions up to and including 1.4.6 are vulnerable to CVE-2026-11390.

References