$PATCH CAsoon

Advisory feed · Saturday, 24 October 20264,534 CVEs published in the last 7 daysSource: NVD, read hourlyAdvisory feedDemo · pretend coins and SOL. The CVE records are real.

TLP:CLEARReceivedPublished 24 Oct 2026 · Updated 24 Oct 2026

CVE-2026-97353

·Not scored yetNo CVSS score yet

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.

No CVSS vector yet. NVD or the CNA hasn’t scored this record.

Affected software: News Kit Addons For Elementor
Versions: through 1.4.7
Weakness: Not stated
Assigned by: wpscan.com
NVD status: Received

ReferencesNVD https://nvd.nist.gov/vuln/detail/CVE-2026-97353 CVE.org https://www.cve.org/CVERecord?id=CVE-2026-97353 https://wpscan.com/vulnerability/4114e6a4-d8ed-4456-a15f-4d47034ae75f/

The record above is NVD’s, word for word, as read before NVD finished its analysis. Coins say nothing about the flaw.

Launch a coin on CVE-2026-97353

Coins filed under CVE-2026-97353

No coins filed yet.

Be the first to file a coin under CVE-2026-97353.

File the first coin

CVE-2026-97353 · Patch Day