Live › vulnerability › CVE-2026-97352
Go to dashboardThe News Kit Addons For Elementor WordPress plugin before 1.4.9 has an AJAX action with no capability check. A logged-in subscriber can use it to install and activate a plugin from the WordPress.org repository.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running News Kit Addons For Elementor before that allow account registration or have subscriber-level users. Sites without the plugin, or with it already updated, are not affected. Sites where only administrators have accounts have a smaller exposure but should still update.
1.4.9No product ranges from the sources yet.
1.4.9 are exposed.1.4.9 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.
This page as .md · .json · in your agent: get_signal("CVE-2026-97352")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.