SZB-2a83c50572
EUVD lists subscriber-level PHP object injection in News Kit Elementor Addons
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Blazethemes
- Product
- News Kit Elementor Addons
- First seen
Summary
An EUVD record (EUVD-2026-112990), shared via a Mastodon post, describes a subscriber-level PHP object injection flaw in News Kit Elementor Addons up to version 1.5.0. The record gives a CVSS v3.1 score of 8.8/10 and was published 2026-10-29 and updated 2026-10-30.
If you use Blazethemes
Update News Kit Elementor Addons to a version later than 1.5.0 once the vendor releases one
Check the EUVD record EUVD-2026-112990 for vendor guidance and patch status
Restrict subscriber account registration until the plugin is fixed
What the sources say 1
· Mastodon: “Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.” Source