ElementsKit Lite < 3.10.01 – Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite) | CVE 2026-13393

Description

The plugin does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfiltered_html, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.

Proof of Concept

Prerequisites:
- WordPress multisite with ElementsKit Lite (<= 3.9.9) and Elementor active on a subsite, DISALLOW_UNFILTERED_HTML in effect.
- The attacker is an Administrator of that subsite only: holds manage_options but is denied unfiltered_html and is NOT a network Super Admin.
- A nav menu with at least one item exists, the ElementsKit megamenu is enabled for that menu's location, and the menu is rendered on a published page via an ElementsKit nav-menu widget.
- On a single-site install this is NOT a vulnerability (an Administrator holds unfiltered_html, so it is self-XSS); the finding is specific to multisite.

Steps (as the non-super subsite Administrator):

1. Log in to the subsite and obtain the logged-in wp_rest nonce (e.g. GET /wp-admin/admin-ajax.php?action=rest-nonce).

2. Store a double-quote-free payload via the genuine save handler (a literal double quote breaks the plugin's own JSON round-trip, so a single-quoted attribute is used):

   GET {subsite}/wp-json/elementskit/v1/megamenu/save_menuitem_settings
   Header: X-WP-Nonce: <nonce>
   Form params:
     settings[menu_id]=<a megamenu item id>
     settings[menu_enable]=1
     settings[menu_badge_text]=<img src=x onerror='alert(document.domain)'>
     settings[menu_badge_background]=red
     settings[menu_badge_color]=white

   Response: {"saved":1,"message":"Saved"}

3. Load the page that renders the megamenu as an anonymous visitor.

Expected result: the response contains the badge markup with the payload echoed unescaped, i.e. the raw <img src=x onerror='alert(document.domain)'> appears in the served HTML (not an html-encoded &lt;img form). The script executes in the session of any viewer, including the network Super Admin, which the subsite Administrator was specifically denied (unfiltered_html) the ability to inject.