CVE-2026-11390 is a stored cross-site scripting vulnerability (CWE-79) in the News Kit Addons For Elementor plugin for WordPress. The flaw exists due to improper neutralization of input during web page generation, specifically in the Site Logo Title and Single Author Box Widgets. Authenticated attackers with contributor-level privileges can inject arbitrary scripts by manipulating the elementor_ajax AJAX save request, circumventing client-side SELECT control restrictions. This vulnerability affects all plugin versions up to and including 1.4.6. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts that execute in the context of users viewing the affected pages. This can lead to partial compromise of confidentiality and integrity (CVSS impact: low confidentiality and integrity impact, no availability impact). The vulnerability does not require user interaction beyond viewing the injected page, and the attack surface is limited to authenticated users with contributor or higher privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity. Consider disabling or limiting use of the affected widgets (Site Logo Title and Single Author Box) if feasible. No vendor-provided official fix or temporary workaround is currently documented.