6.8
Medium
CVE-2026-84902 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when…
Description
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| King Addons for Elementor 51.1 | earliest → < 51.1.81 | 51.1.81 |
Other CVEs of King Addons for Elementor
The 5 CVEs of King Addons for Elementor →
CVE-2026-84904
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a…
3.8
Low
CVE-2026-84903
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password…
2.7
Low
CVE-2026-84896
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before…
6.8
Medium
CVE-2026-14841
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before…
6.1
Medium