CVE-2026-84896
Received Received - Intake

Stored Cross-Site Scripting in King Addons for Elementor WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-84896
EUVD
EUVD-2026-71865

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
king_addons the_king_addons_for_elementor to 51.1.77 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the King Addons for Elementor WordPress plugin before version 51.1.77. It occurs because the plugin does not properly escape a widget display-style setting before outputting it in an HTML attribute.

Detection Guidance

Check the installed version of the King Addons for Elementor plugin. If it is below 51.1.77, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

Users with Contributor-level access or higher can inject malicious JavaScript that executes in the browsers of any visitor to the affected page, including logged-in administrators. This could lead to unauthorized actions, data theft, or session hijacking.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compliance may be compromised if user data is exposed or manipulated.

Mitigation Strategies

Update the King Addons for Elementor plugin to version 51.1.77 or later immediately. Remove or disable the plugin if an update is not available. Review user roles with Contributor-level access or higher for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84896. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart