Vulnerabilities / Thim Kit for Elementor / WPSEC-2026-2762
Thim Kit for Elementor <= 1.4.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Text Reveal Animation
Medium 6.4
CWE-79Fixed in 1.4.9
- ID
- WPSEC-2026-2762
- Plugin
- Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor (thim-elementor-kit)
- Affected
- from 1.4.2 before 1.4.9
- Remediation
- Update to 1.4.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-10
- Attack surface
- Thim Kit for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Thim Kit for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'Text Reveal' (ekit--fx-word-reveal) text animation in all versions up to, and including, 1.4.8 due to the front-end script rebuilding animated headings and paragraphs from their decoded text content and attribute values without escaping, and writing the result back to the page with innerHTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-2762/
- https://plugins.svn.wordpress.org/thim-elementor-kit/tags/1.4.9/
- https://wordpress.org/plugins/thim-elementor-kit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS