CVE-2026-84902
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The King Addons for Elementor WordPress plugin before version 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.
Risk Assessment
The risk includes the ability to take over page content, inject malicious scripts that can steal data or hijack sessions, and privilege escalation.
Recommendation
Update the plugin to version 51.1.81 or later and restrict permissions for users with contributor role and above.
Other vulnerabilities in King Addons for Elementor
See all- CVE-2026-66575Medium
The King Addons for Elementor plugin in versions up to and including 51.1.81 contains an Insecure Direct Object References (IDOR) vulnerability. An unauthenticated attacker can access objects they should not have access to.
- CVE-2026-84904Low
The King Addons for Elementor WordPress plugin before version 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.
- CVE-2026-84903Low
The King Addons for Elementor WordPress plugin before version 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.
- CVE-2026-84896Medium
The King Addons for Elementor WordPress plugin before version 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.
- CVE-2026-15284Medium
The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to and including 51.1.62. This is due to insufficient input sanitization in the add_to_submissions() function and missing output escaping in the king_addons_submissions_custom_column_content() function.
- CVE-2026-48870Medium
The King Addons plugin for Elementor versions up to 51.1.62 contains a Subscriber Cross Site Scripting (XSS) vulnerability.
Original NVD description (English source)
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS