CVE-2026-97352
Medium
Description
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.
SeverityMedium
CVSS4.3
Exploit probability—
ProductNews Kit Addons For Elementor
PublishedOct 24, 2026
First seenOct 24, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- News Kit Addons For Elementor1.4.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| News Kit Addons For Elementor | v < 1.4.9 | 1.4.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.