Vulnerability · Published Sep 18, 2026 · Assigned by WPScan

CVE-2026-84902King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import

Medium 6.8

In plain English

A medium-severity cross-site scripting in King Addons for Elementor from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 62.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.

Affected products (as reported)

Vendor	Product	Versions
Unknown	King Addons for Elementor	0 – before 51.1.81

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/4afc5f30-8b30-4e77-9bd7-91c25065bb54/ exploit, vdb-entry, technical-description