The ElementsKit Lite WordPress plugin before version 3.10.01 stores megamenu menu‑item settings without sanitizing or escaping them. Because the plugin does not enforce the unfiltered_html capability when saving these settings, an administrator with subsite privileges on a multisite network can insert unsanitized JavaScript. Once the payload is stored it is rendered unchanged on the front end, resulting in a stored Cross‑Site Scripting vulnerability that can compromise the browser context of all users, including network Super Administrators, leading to session hijacking, data theft, or defacement.

WordPress sites that use the ElementsKit Lite plugin (Elementor Addons) and have a version earlier than 3.10.01 in a multisite configuration are impacted. All sites in the network that employ the plugin in this state are susceptible to the flaw.

The CVSS score of 3.5 and an EPSS score of <1% indicate a low base severity and low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless the attack vector is clear: any subsite Administrator can inject malicious code into a megamenu configuration without needing the unfiltered_html capability, and the stored payload will run on every page load for any visitor, including network Super Administrators. The potential impact on confidentiality, integrity, and availability is significant because the attacker can hijack sessions, exfiltrate data, or redirect users to phishing sites.