CVE-2026-2600 is a stored cross-site scripting vulnerability in the ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor WordPress plugin. The issue is due to improper neutralization of input in the 'ekit_tab_title' parameter within the Simple Tab widget, allowing authenticated users with contributor-level privileges or higher to inject arbitrary scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all plugin versions up to 3.7.9. No official patch or remediation guidance has been provided by the vendor as of the published date.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no indication of availability impact. The vulnerability requires authentication and is rated medium severity with a CVSS score of 6.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level access to trusted users only. Review and sanitize user inputs in the 'ekit_tab_title' parameter if possible through custom code or security plugins. Monitor for plugin updates from the vendor that address this vulnerability.