The News Kit Addons For Elementor plugin contains a stored XSS flaw tied to the formData parameter used in the nekit_update_mega_menu_form AJAX action. When an authenticated user with subscriber-level access submits data, insufficient sanitization allows angle brackets encoded as \\u003c or \\u003e to survive policing and be decoded back to literal angle brackets. This lets the attacker inject arbitrary JavaScript into the _elementor_data field of any post, resulting in malicious scripts that execute whenever a page containing that post is viewed by other users. The impact includes defacement, theft of user credentials, and potential session hijacking, all originating from the persistence of malicious code in content elements.

Vendor: blazethemes; Product: News Kit Addons For Elementor plugin for WordPress. Versions affected are all releases through and including 1.4.8.

The vulnerability holds a CVSS score of 6.4, indicating moderate severity. EPSS data is unavailable, and the flaw has not been listed in CISA KEV. Exploitation requires the attacker to be authenticated, with at least subscriber privileges, and to have access to the admin interface where the AJAX endpoint is accessible. Once the vulnerable action is triggered, injected scripts persist in post content and execute in the browsers of any user who loads the affected page, making this a persistent threat for sites that rely on this plugin.