Vulnerability · Published Jul 31, 2026 · Assigned by WPScan

CVE-2026-13392ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

High 7.2

In plain English

A high-severity code injection in ElementsKit Elementor Addons from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.7%top 48.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them.

Affected products (as reported)

Vendor	Product	Versions
Unknown	ElementsKit Elementor Addons	0 – before 3.10.01

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/955cbef5-51c3-4d10-86d2-e2882bbb56a4/ exploit, vdb-entry, technical-description