CVE-2025-0968 json
ElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function
published 2025-02-19 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-4703
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a missing capability checks on the get_megamenu_content() function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, trashed and private items.
Patch / fix
- wpmet elements_kit_elementor_addons 3.4.1
- wpmet elementskit_elementor_addons 3.4.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected products
- roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
Classification
- Weakness
- Technology feeds
References
-
plugins.trac.wordpress.org
/changeset/3237243/
patch
-
wordfence.com
/threat-intel/vulnerabilities/id/432ac3b1-8f1d-442f-8e8d-62a1f26ba259?source=cve
third-party-advisory
-
plugins.trac.wordpress.org
/browser/elementskit-lite/trunk/modules/megamenu/api.php#L47
product
-
wordpress.org
/plugins/elementskit-lite/#developers
product, release-notes
Sources
- CVE List CVE-2025-0968
- NVD CVE-2025-0968
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.