CVE-2026-4362mediumCWE-862

CVE-2026-4362: medium-severity vulnerability in roxnor ElementsKit Elementor Addons – Advanced…

ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite

Published

Follow this CVE+ Monitor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.4%
The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `Live_Action::reset()` function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress `init` action and triggers when both `post` and `action=elementor` GET parameters are present, with no authentication or nonce verification. This makes it possible for unauthenticated attackers to overwrite the Elementor content (`_elementor_data`) of any `elementskit_widget` custom post type by visiting a specially crafted URL. The widget's custom designs, text, and configurations are permanently replaced with a blank template.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
roxnor · ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
Related CVEs — roxnor ElementsKit Elementor Addons – Advanced…

In the same product, most dangerous first.

CVE-2024-2047HIGHElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_rawEPSS 1.5%CVE-2024-3499HIGHElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll ModuleEPSS 1.1%CVE-2023-6582MEDIUMElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information ExposureEPSS 0.5%CVE-2025-0968MEDIUMElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content FunctionEPSS 0.5%CVE-2024-2042MEDIUMElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetEPSS 0.5%CVE-2024-8546MEDIUMElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video WidgetEPSS 0.4%