All vulnerabilities
CVE-2026-97352

News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

Unknown News Kit Addons For Elementor
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.4.9Fixed versionCVE List
Published24 Oct 2026Updated 24 Oct 2026CVE List

What fixes it

  • 1.4.9News Kit Addons For ElementorCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.

Text from CVE List

Affected versions 1

  • News Kit Addons For Elementoraffected: all versions before 1.4.9CVE List

References 1