Vulnerabilities and security researches foranalogwp-templates analogwp-templates

Jun 07, 2024

CVE, Research URL: CVE-2021-4401
Home page URL: Security reports for Style Kits – Advanced Theme Styles for Elementor
Application: Style Kits – Advanced Theme Styles for Elementor
Date: Jul 01, 2023
Research Description: The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to missing or incorrect nonce validation on the update_posts_stylekit() function. This makes it possible for unauthenticated attackers to update style kits for posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 1.8.1.
Status: vulnerable

CVE, Research URL: 6a458c9819b8e298c3a10471d934967bc21ed821
Home page URL: Security reports for Style Kits – Advanced Theme Styles for Elementor
Application: Style Kits – Advanced Theme Styles for Elementor
Date: Mar 01, 2021
Research Description: Style Kits – Advanced Theme Styles for Elementor [analogwp-templates] < 1.8.1 WordPress Style Kits plugin <= 1.8.0 - Cross-Site Request Forgery (CSRF) vulnerability Cross-Site Request Forgery (CSRF) vulnerability found by NintechNet in WordPress Style Kits plugin (versions <= 1.8.0).
Affected versions: max 1.8.1.
Status: vulnerable

CVE, Research URL: -
Home page URL: Security reports for Style Kits – Advanced Theme Styles for Elementor
Application: Style Kits – Advanced Theme Styles for Elementor
Date: Jun 07, 2023
Research Description: Rejected reason: CVE split into individual CVE IDs for each software record.
Affected versions: max 1.8.1.
Status: vulnerable

May 28, 2026

CVE, Research URL: CVE-2026-6565
Home page URL: Security reports for Style Kits – Advanced Theme Styles for Elementor
Application: Style Kits – Advanced Theme Styles for Elementor
Date: May 27, 2026
Research Description: The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/wp-json/agwp/v1/tokens/save' endpoint kit title parameter in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping in an admin attribute context. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 2.6.0.
Status: vulnerable