# Thim Kit for Elementor <= 1.4.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Text Reveal Animation

- **ID:** WPSEC-2026-2762
- **Plugin:** Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor (`thim-elementor-kit`), https://wordpress.org/plugins/thim-elementor-kit/
- **Affected versions:** from 1.4.2 before 1.4.9
- **Fixed in:** 1.4.9 (Update to 1.4.9 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/thim-elementor-kit
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2762/

## Description

The Thim Kit for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'Text Reveal' (ekit--fx-word-reveal) text animation in all versions up to, and including, 1.4.8 due to the front-end script rebuilding animated headings and paragraphs from their decoded text content and attribute values without escaping, and writing the result back to the page with innerHTML. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2762/
- https://plugins.svn.wordpress.org/thim-elementor-kit/tags/1.4.9/
- https://wordpress.org/plugins/thim-elementor-kit/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2762/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.