CVE-2026-84896
UnknownSummary
The King Addons for Elementor WordPress plugin before version 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.
Risk Assessment
Stored XSS can lead to administrator account compromise, data theft, or unauthorized content modification.
Recommendation
Update the King Addons for Elementor plugin to version 51.1.77 or later, which includes a fix for escaping style settings.
Other vulnerabilities in King Addons for Elementor
See all- CVE-2026-15284Medium
The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to and including 51.1.62. This is due to insufficient input sanitization in the add_to_submissions() function and missing output escaping in the king_addons_submissions_custom_column_content() function.
- CVE-2026-48870Medium
The King Addons plugin for Elementor versions up to 51.1.62 contains a Subscriber Cross Site Scripting (XSS) vulnerability.
Original NVD description (English source)
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.