WordPress plugin

News Kit Addons For Elementor security & vulnerabilities

Q: Is any News Kit Addons For Elementor vulnerability listed in CISA KEV?

No. None of the known News Kit Addons For Elementor vulnerabilities is currently listed in the CISA KEV catalog.

news-kit-elementor-addons— active installsLast vulnerability Oct 28, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin

10Known vulnerabilities

Critical0
High1
Medium9
Low0

Vulnerabilities per year

All News Kit Addons For Elementor vulnerabilities

News Kit Addons For Elementor vulnerabilities
Severity	Vulnerability	CVE	Published
High7.5	Authenticated (Subscriber+) PHP Object Injection ≤1.5.0No patch available	CVE-2026-118073	Oct 28
Medium4.3	Missing Authorization ≤1.4.7No patch available	CVE-2026-97353	Oct 21
Medium4.3	Missing Authorization ≤1.4.8Update to 1.4.9	CVE-2026-97352	Oct 21
Medium6.4	Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action ≤1.4.8Update to 1.4.9	CVE-2026-120524	Oct 16
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets ≤1.4.6Update to 1.4.7	CVE-2026-11390	Jul 13
Medium4.3	Missing Authorization ≤1.4.2Update to 1.4.3	CVE-2026-25416	Jan 28
Medium4.3	Missing Authorization ≤1.3.4Update to 1.3.5	CVE-2025-54037	Jul 16, 2025
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.3.6No patch available	CVE-2025-32196	Apr 4, 2025
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.4.6Update to 1.4.7	CVE-2024-54260	Dec 5, 2024
Medium4.3	Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template ≤1.2.1Update to 1.2.2	CVE-2024-9541	Oct 21, 2024

High7.5
Authenticated (Subscriber+) PHP Object Injection
≤1.5.0No patch available
CVE-2026-118073Oct 28
Medium4.3
Missing Authorization
≤1.4.7No patch available
CVE-2026-97353Oct 21
Medium4.3
Missing Authorization
≤1.4.8Update to 1.4.9
CVE-2026-97352Oct 21
Medium6.4
Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action
≤1.4.8Update to 1.4.9
CVE-2026-120524Oct 16
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets
≤1.4.6Update to 1.4.7
CVE-2026-11390Jul 13
Medium4.3
Missing Authorization
≤1.4.2Update to 1.4.3
CVE-2026-25416Jan 28
Medium4.3
Missing Authorization
≤1.3.4Update to 1.3.5
CVE-2025-54037Jul 16, 2025
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.3.6No patch available
CVE-2025-32196Apr 4, 2025
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.4.6Update to 1.4.7
CVE-2024-54260Dec 5, 2024
Medium4.3
Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template
≤1.2.1Update to 1.2.2
CVE-2024-9541Oct 21, 2024

News Kit Addons For Elementor: common questions

Does News Kit Addons For Elementor have known vulnerabilities?

Yes. VulnCrest Radar lists 10 known vulnerabilities in News Kit Addons For Elementor: 1 high, 9 medium. At least one is not fixed in the latest version.

How do I check which version of News Kit Addons For Elementor I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent News Kit Addons For Elementor vulnerability?

CVE-2026-118073, published Oct 28, 2026: News Kit Addons For Elementor <= 1.5.0 - Authenticated (Subscriber+) PHP Object Injection. Severity: High (CVSS 7.5).

Is any News Kit Addons For Elementor vulnerability listed in CISA KEV?

No. None of the known News Kit Addons For Elementor vulnerabilities is currently listed in the CISA KEV catalog.