CVE WATCH / VULNERABILITY DETAIL
CVE-2026-97353
MEDIUMCVSS 5.4NVD feed
Published 24 October 2026 · tracked since 24 October 2026
Description
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-115972 MEDIUM 5.3
- CVE-2026-114704 HIGH 7.2
- CVE-2026-116016 HIGH 7.1
- CVE-2026-116010 MEDIUM 4.3
- CVE-2026-110018 HIGH 8.8
- CVE-2026-94075 CRITICAL 9.8
- CVE-2026-114693 MEDIUM 6.5
- CVE-2026-114196 CRITICAL 9.8
- CVE-2026-115802 MEDIUM 4.3
- CVE-2026-108013 MEDIUM 6.8