CVE-2026-4246: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpmet ElementsKit Pro

The ElementsKit Pro plugin for WordPress is vulnerable to stored cross-site scripting (CWE-79) via the 's' parameter of its Advanced Search REST endpoint (/wp-json/elementskit/v1/advanced-search). The endpoint uses a permission callback that allows unauthenticated access. Search terms are stored in the WordPress option 'ekit_advanced_search_popular_keyword' using update_option(). Although sanitize_text_field() is applied to input, it does not encode double quotes, and the stored keywords are rendered in HTML attributes without esc_attr(), enabling attribute injection. This allows unauthenticated attackers to inject arbitrary JavaScript that executes when users trigger the 'no results' popular keywords view on pages using the Advanced Search widget.

An unauthenticated attacker can inject malicious scripts that execute in the context of users visiting pages with the Advanced Search widget, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability affects confidentiality and integrity of user interactions but does not impact availability.

No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the Advanced Search widget or restricting access to the vulnerable REST endpoint if possible.