Plugin icon

LA-Studio Element Kit for Elementor

lastudio-element-kit

Vulnerabilities:

18

Last Updated:

January 14, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-01-21
Title
LA-Studio Element Kit for Elementor < 1.6.0 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter
Fixed in
Fixed in 1.6.0
CVSS
9.8 (critical)
Published
2025-12-15
Title
LA-Studio Element Kit for Elementor < 1.5.6.3 - Missing Authorization
Fixed in
Fixed in 1.5.6.3
CVSS
5.3 (medium)
Published
2025-09-05
Title
LA-Studio Element Kit for Elementor < 1.5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Fixed in
Fixed in 1.5.5.2
CVSS
6.4 (medium)
Published
2025-05-29
Title
LA-Studio Element Kit for Elementor < 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets
Fixed in
Fixed in 1.5.3
CVSS
6.4 (medium)
Published
2025-05-29
Title
LA-Studio Element Kit for Elementor < 1.5.3 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link Parameter
Fixed in
Fixed in 1.5.3
CVSS
6.4 (medium)
Published
2025-04-17
Title
LA-Studio Element Kit for Elementor < 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table of Contents Widget
Fixed in
Fixed in 1.5.0
CVSS
6.4 (medium)
Published
2025-04-04
Title
LA-Studio Element Kit for Elementor < 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.5.2
CVSS
6.4 (medium)
Published
2024-12-03
Title
LA-Studio Element Kit for Elementor < 1.4.5 - Authenticated (Contributor+) Post Disclosure
Fixed in
Fixed in 1.4.5
CVSS
4.3 (medium)
Published
2024-11-22
Title
LA-Studio Element Kit for Elementor < 1.4.3 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 1.4.3
CVSS
8.8 (high)
Published
2024-09-30
Title
LA-Studio Element Kit for Elementor < 1.3.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.9.7
CVSS
6.4 (medium)
Published
2024-08-09
Title
LA-Studio Element Kit for Elementor < 1.3.9.3 - Contributor+ Stored XSS
Fixed in
Fixed in 1.3.9.2
CVSS
5.9 (medium)
Published
2024-07-02
Title
LA-Studio Element Kit for Elementor < 1.3.9 - Authenticated (Contributor+) Local File Inclusion via 'progress_type'
Fixed in
Fixed in 1.3.9
CVSS
5.4 (medium)
Published
2024-07-01
Title
LA-Studio Element Kit for Elementor < 1.3.9 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 1.3.9
CVSS
8.8 (high)
Published
2024-06-06
Title
LA-Studio Element Kit for Elementor < 1.3.7.4 - Missing Authorization
Fixed in
Fixed in 1.3.7.4
CVSS
5.3 (medium)
Published
2024-05-22
Title
LA-Studio Element Kit for Elementor < 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Fixed in
Fixed in 1.3.8
CVSS
6.4 (medium)
Published
2024-05-01
Title
LA-Studio Element Kit for Elementor < 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget
Fixed in
Fixed in 1.3.7.6
CVSS
6.4 (medium)
Published
2024-03-14
Title
LA-Studio Element Kit for Elementor < 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.7.5
CVSS
6.4 (medium)
Published
2023-12-26
Title
LA-Studio Element Kit for Elementor < 1.1.6 - Missing Authorization
Fixed in
Fixed in 1.1.6
CVSS
5.3 (medium)