AnalogWP vulnerabilities

Products

• Style Kits 3
• Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns 1
• Style Kits for Elementor 1

Latest AnalogWP CVEs

Newest publication first

1. CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

   Published 2026-08-24

   Medium·CVSS 6.5 EPSS 0.30%

   Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.

2. CVE-2026-65484 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

   Published 2026-07-23

   Medium·CVSS 6.3 EPSS 0.26%

   Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

3. CVE-2026-6565 Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title

   Published 2026-05-27

   Medium·CVSS 6.4 EPSS 0.16%

   The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/wp-json/agwp/v1/tokens/save' endpoint kit title parameter in versions up to, and including, 2.5.0 due to insuffici...

4. CVE-2021-4401 Style Kits <= 1.8.0 - Cross-Site Request Forgery Bypass

   Published 2023-07-01

   High·CVSS 8.8 EPSS 0.53%

   The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to missing or incorrect nonce validation on the update_posts_stylekit() function. This makes it possible for unauthenticated attackers to update st...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.