{
 "id": "WPSEC-2026-2762",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2762/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2762/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2762/index.md",
 "title": "Thim Kit for Elementor <= 1.4.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Text Reveal Animation",
 "description": "The Thim Kit for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'Text Reveal' (ekit--fx-word-reveal) text animation in all versions up to, and including, 1.4.8 due to the front-end script rebuilding animated headings and paragraphs from their decoded text content and attribute values without escaping, and writing the result back to the page with innerHTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
 "plugin": {
  "slug": "thim-elementor-kit",
  "name": "Thim Kit for Elementor",
  "full_name": "Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor",
  "wordpress_org": "https://wordpress.org/plugins/thim-elementor-kit/",
  "advisories_url": "https://wpsec.com/vuln/plugin/thim-elementor-kit/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/thim-elementor-kit"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.4.2",
    "from_inclusive": true,
    "to": "1.4.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.4.2 before 1.4.9"
  ]
 },
 "introduced_in": "1.4.2",
 "fixed_in": "1.4.9",
 "remediation": "Update to 1.4.9 or later.",
 "fix_released": "2026-11-09T02:08:33+00:00",
 "published": "2026-11-10T02:41:56+00:00",
 "updated": "2026-11-09T23:33:39.891941+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2762/",
  "https://plugins.svn.wordpress.org/thim-elementor-kit/tags/1.4.9/",
  "https://wordpress.org/plugins/thim-elementor-kit/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/thim-elementor-kit",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-10"
 }
}