King Addons for Elementor vulnerabilities
3 known CVE vulnerabilities in King Addons for Elementor, translated and rated.
- CVE-2026-84896Unknown
The King Addons for Elementor WordPress plugin before version 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.
- CVE-2026-15284Medium
The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to and including 51.1.62. This is due to insufficient input sanitization in the add_to_submissions() function and missing output escaping in the king_addons_submissions_custom_column_content() function.
- CVE-2026-48870Medium
The King Addons plugin for Elementor versions up to 51.1.62 contains a Subscriber Cross Site Scripting (XSS) vulnerability.