CVE-2026-15284
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to and including 51.1.62. This is due to insufficient input sanitization in the add_to_submissions() function and missing output escaping in the king_addons_submissions_custom_column_content() function.
Risk Assessment
Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts that execute when users access affected pages, potentially leading to session theft, redirects, or other malicious activities.
Recommendation
Immediately update the King Addons for Elementor plugin to the latest available version that addresses this vulnerability. Additionally, restrict user permissions to the minimum necessary.
Other vulnerabilities in King Addons for Elementor
See all- CVE-2026-84896Unknown
The King Addons for Elementor WordPress plugin before version 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.
- CVE-2026-48870Medium
The King Addons plugin for Elementor versions up to 51.1.62 contains a Subscriber Cross Site Scripting (XSS) vulnerability.
Original NVD description (English source)
The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to, and including, 51.1.62 This is due to insufficient input sanitization in the add_to_submissions() function, which applies sanitize_text_field() (which preserves double-quote characters) before storing the value in post meta, combined with missing output escaping in the king_addons_submissions_custom_column_content() function, which concatenates the stored value into an HTML href attribute via admin_url() without wrapping the result in esc_url(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.