CVE-2026-84896

Received Received - Intake

Stored Cross-Site Scripting in King Addons for Elementor WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-06

Assigner: WPScan

Description

The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-05

Last Modified

2026-09-06

Generated

2026-09-25

AI Q&A

2026-09-05

EPSS Evaluated

2026-09-24

NVD

CVE-2026-84896

EUVD

EUVD-2026-71865

Affected Vendors & Products

Vendor	Product	Version / Range
king_addons	the_king_addons_for_elementor	to 51.1.77 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the King Addons for Elementor WordPress plugin before version 51.1.77. It occurs because the plugin does not properly escape a widget display-style setting before outputting it in an HTML attribute.

Detection Guidance

Check the installed version of the King Addons for Elementor plugin. If it is below 51.1.77, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

Users with Contributor-level access or higher can inject malicious JavaScript that executes in the browsers of any visitor to the affected page, including logged-in administrators. This could lead to unauthorized actions, data theft, or session hijacking.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compliance may be compromised if user data is exposed or manipulated.

Mitigation Strategies

Update the King Addons for Elementor plugin to version 51.1.77 or later immediately. Remove or disable the plugin if an update is not available. Review user roles with Contributor-level access or higher for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-84896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70