EUVD-2025-209162
GHSA-96wm-hfgm-fcxx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The King Addons for Elementor plugin for WordPress is vulnerable to multiple Contributor+ DOM-Based Stored Cross-Site Scripting vulnerabilities in all versions up to, and including, 51.1.38. This is due to insufficient input sanitization and output escaping across multiple widgets and features. The plugin uses esc_attr() and esc_url() within JavaScript inline event handlers (onclick attributes), which allows HTML entities to be decoded by the DOM, enabling attackers to break out of the JavaScript context. Additionally, several JavaScript files use unsafe DOM manipulation methods (template literals, .html(), and window.location.href with unvalidated URLs) with user-controlled data. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via Elementor widget settings that execute when a user accesses the injected page or when an administrator previews the page in Elementor's editor. The vulnerability was partially patched in version 5.1.51.
AnalysisAI
King Addons for Elementor plugin versions up to 51.1.38 contain multiple DOM-Based Stored Cross-Site Scripting vulnerabilities affecting authenticated Contributor+ users. The plugin improperly escapes user input in JavaScript inline event handlers and uses unsafe DOM manipulation methods in widget settings, allowing attackers with Contributor-level access to inject arbitrary JavaScript that executes when pages are accessed or previewed in the Elementor editor. A partial patch was released in version 5.1.51, though the version numbering discrepancy suggests incomplete remediation across all vulnerable code paths.
Technical ContextAI
The vulnerability stems from CWE-79 (Cross-site Scripting) rooted in WordPress plugin architecture where Elementor widget settings lack proper defense-in-depth output encoding. The root cause involves two distinct technical failures: (1) misuse of WordPress escaping functions-specifically esc_attr() and esc_url()-within JavaScript onclick attributes, which allow HTML entities to be decoded by the DOM parser and re-interpreted as JavaScript context-breakers; and (2) unsafe DOM manipulation in JavaScript files using template literals, .html() method calls, and window.location.href assignments that directly consume unvalidated user-controlled data from widget configuration. The Elementor widget framework stores user input in post metadata without proper sanitization, and the rendering layer fails to apply context-aware escaping (JavaScript escaping would be required for event handlers, not HTML entity encoding). Affected JavaScript files including lightgallery.js, Countdown/script.js, and Image_Accordion/script.js demonstrate unsafe patterns, while multiple widgets (Video_Popup, Off_Canvas_Content, Popup, Pricing_Calculator, and the Wrapper_Link feature) embed vulnerable inline event handlers in generated HTML.
RemediationAI
Update King Addons for Elementor to version 5.1.51 or later to address the partial patch released in that version. However, given the description notes the patch was only partial, review the WordPress.org plugin repository and Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/95d3e76c-612d-436c-9d32-6228d7dcbf35?source=cve) for confirmation of complete remediation or additional patch releases. As an immediate mitigation, restrict Contributor-level permissions to trusted users only, and audit existing Elementor pages and widget settings for injected content using the WordPress admin interface. Consider using Web Application Firewall rules to detect and block script injection patterns in POST requests to Elementor widget endpoints (wp-json/elementor/v1/posts/*). Monitor administrator audit logs for unauthorized widget configuration changes, particularly in Video_Popup, Off_Canvas_Content, Popup, Pricing_Calculator, and Wrapper_Link widgets, which are explicitly listed as vulnerable in the referenced code paths.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today