Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97353— News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form

Quick assessment

Affected
Unknown News Kit Addons For Elementor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Elementor 的 News Kit Addons WordPress 插件（1.4.7 及以下版本）在某个经过身份验证的 AJAX 操作更新文章元数据时，未执行能力（capability）或所有权（ownership）检查。这使得拥有订阅者（subscriber）及以上权限的用户能够以攻击者指定的键名，向任意文章（包括由其他用户创建的文章）写入任意文章元数据。攻击者可利用此漏洞覆盖受保护的核心元数据，并篡改高权限用户创建的内容。

AI Predicted 7.8 Difficulty: Easy

Possible ATT&CK Techniques 2 AI

T1078.004 · Cloud Accounts T1562.004
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97353

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form
Source: CVE Program / CVE List V5
Vulnerability Description
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown News Kit Addons For Elementor 0 ~ 1.4.7 -

II. Public POCs for CVE-2026-97353

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97353

请登录查看更多情报信息。

Other References for CVE-2026-97353 (1)

Same Patch Batch · Unknown · 2026-10-24 · 16 CVEs total

CVE-2026-114429 WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
CVE-2026-113674 GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
CVE-2026-113673 GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
CVE-2026-113493 GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
CVE-2026-112207 Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
CVE-2026-113489 GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
CVE-2026-113490 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup RE
CVE-2026-113492 GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed
CVE-2026-113491 GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
CVE-2026-110956 asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
CVE-2026-105199 Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager
CVE-2026-87835 Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assig
CVE-2026-107887 Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_th
CVE-2026-107907 MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist
CVE-2026-97352 News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via

IV. Related Vulnerabilities

Same product: News Kit Addons For Elementor
Same vendor: Unknown

V. Comments for CVE-2026-97353

No comments yet

Leave a comment