CVE-2026-97353

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/4114e6a4-d8ed-4456-a15f-4d47034ae75f/

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

VulDB 🛡@vuldb1d
🚨 A lot of offensive activities were identified targeting News Kit Addons for Elementor Plugin (CVE-2026-97353) vuldb.com/vuln/426071/cti https://t.co/cK18tn2FCR
0000080
2.3K followersView on X

Explore more

Back to dashboard