Description

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at /wp-json/elementskit/v1/advanced-search uses permission_callback set to __return_true, allowing unauthenticated access. Search terms are stored in the ekit_advanced_search_popular_keyword WordPress option via update_option(). While sanitize_text_field() is applied, it does not encode double quotes, and the stored keywords are rendered in HTML attributes via sprintf without esc_attr(), allowing attribute injection. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user triggers the "no results" popular keywords view on pages using the Advanced Search widget.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-28T08:16:40.850Z",
  "pubdate": "2026-08-28T08:16:40.850Z",
  "executiveSummary": "ElementsKit Pro versions up to and including 4.10.1 contain a critical Stored Cross-Site Scripting (XSS) vulnerability within the Advanced Search REST endpoint.\nThe vulnerability originates from inadequate input sanitization and a failure to apply context-aware output escaping when processing user-supplied search queries.\nThe REST endpoint is configured with a public permission callback, allowing unauthenticated attackers to interact with the API without prior authorization.\nBy injecting malicious payloads into the 's' parameter, an attacker can influence the persistent 'ekit_advanced_search_popular_keyword' option in the WordPress database.\nSuccessful exploitation results in the execution of arbitrary JavaScript within the context of the victim's browser when they view the 'no results' popular keywords section.\nThis vulnerability poses a significant risk to the integrity and confidentiality of user sessions, as it enables attackers to perform unauthorized actions on behalf of authenticated users, such as administrators, potentially leading to full site compromise.\nExploitation requires no authentication, making it reachable by any remote actor with access to the public-facing WordPress REST API.",
  "technicalDetails": "The vulnerability resides in the /wp-json/elementskit/v1/advanced-search REST endpoint of the ElementsKit Pro plugin. The endpoint registers an unauthenticated route by setting the 'permission_callback' to '__return_true', which circumvents all standard WordPress access control checks.\nThe root cause is a failure to safely handle user input submitted via the 's' parameter. While the plugin utilizes 'sanitize_text_field()' before storing the input in the 'ekit_advanced_search_popular_keyword' WordPress option, this function is insufficient for protecting against attribute-based XSS because it does not encode double quotes.\nWhen the Advanced Search widget triggers a 'no results' state, it fetches the stored keywords and renders them into the DOM. Because the rendering process uses 'sprintf' without wrapping the variables in 'esc_attr()', the unsanitized double quotes allow for premature termination of the HTML attribute.\nThe attack flow begins with an unauthenticated attacker sending an HTTP POST request to the Advanced Search endpoint containing a malicious payload crafted to break out of the HTML attribute. For example, a payload containing '\" onmouseover=\"alert(1)\" ' can be used to inject event handlers into the rendered HTML.\nOnce the payload is saved in the 'ekit_advanced_search_popular_keyword' option, it becomes persistent. Whenever a visitor, including privileged administrators, interacts with a page where the Advanced Search widget is configured to display popular keywords, the injected script is reflected in the victim's browser context.\nPost-exploitation, the injected JavaScript executes with the permissions of the current user. This allows attackers to perform unauthorized administrative actions, capture session cookies, or redirect users to malicious domains. Since this is a stored XSS vulnerability, the payload remains active until the 'ekit_advanced_search_popular_keyword' option is manually cleared from the database or overwritten by subsequent legitimate searches."
}