Live › vulnerability › CVE-2026-118073
News Kit Elementor Addons up to version 1.5.0 lets a logged-in subscriber inject serialized PHP objects. An attacker with a basic subscriber account may be able to run code or alter data on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the News Kit Elementor Addons WordPress plugin at version 1.5.0 or earlier are exposed. The attacker needs a subscriber account, so sites that allow open registration are the most at risk; sites without that plugin can skip it.
No product ranges from the sources yet.
1.5.0; the exact fixed version is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118073")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.