{"apiVersion":"1.0","identifier":"CVE-2026-4246","description":"The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the -s- parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at /wp-json/elementskit/v1/advanced-search uses permission_callback set to __return_true, allowing unauthenticated access. Search terms are stored in the ekit_advanced_search_popular_keyword WordPress option via update_option(). While sanitize_text_field() is applied, it does not encode double quotes, and the stored keywords are rendered in HTML attributes via sprintf without esc_attr(), allowing attribute injection. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user triggers the -no results- popular keywords view on pages using the Advanced Search widget.","publishedAt":"2026-08-28T08:16:40","lastModifiedAt":"2026-08-28T15:09:00","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-4246","cvssScore":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","epssProbability":0.00274,"riskScore":0.63,"affectedProduct":"ElementsKit Pro","affectedVersions":"<=4.10.1","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-4246","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-4246","en":"https://www.redsauce.net/en/cves/CVE-2026-4246","fr":"https://www.redsauce.net/fr/cves/CVE-2026-4246","pt":"https://www.redsauce.net/pt/cves/CVE-2026-4246","de":"https://www.redsauce.net/de/cves/CVE-2026-4246","sk":"https://www.redsauce.net/sk/cves/CVE-2026-4246","el":"https://www.redsauce.net/el/cves/CVE-2026-4246"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-4246"}}