CVE-2026-97352

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-10-24

Last modified

2026-10-26

Weaknesses

CWE-862

Affected products

• News Kit Addons For Elementor (Unknown)

References

• https://wpscan.com/vulnerability/36f192be-f684-494c-8b37-9dd006407b6f/