EUVD-2026-82661
GHSA-49x6-35hm-mhc5
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor role = PR:L (not vendor's PR:H); arbitrary admin-page content overwrite gives I:H, stored XSS crossing into other users' sessions gives S:C and C:L; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.
AnalysisAI
Stored cross-site scripting and unauthorized content tampering in the King Addons for Elementor WordPress plugin (all versions before 51.1.81) allow authenticated users with contributor-level access or above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, because the template-import feature performs no object-level authorization check. A widget setting is written to the page and rendered without escaping, so the injected JavaScript executes in the session of any user who later views the tampered page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account at contributor role or above (the description explicitly names 'contributor-level access and above'), and the King Addons for Elementor plugin at a version before 51.1.81 must be installed and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but privilege-gated issue rather than a wormable critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade King Addons for Elementor to 51.1.81 or later (the advisory is published at https://wpscan.com/vulnerability/4afc5f30-8b30-4e77-9bd7-91c25065bb54/ with the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-84902). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in King Addons For Elementor
View allStored cross-site scripting in King Addons for Elementor WordPress plugin before version 51.1.77 allows any Contributor-
Reflected XSS in King Addons for Elementor (all versions before 51.1.76) permits unauthenticated attackers to inject and
Missing per-object authorization checks in the King Addons for Elementor WordPress plugin (affected range 51.1.56 throug
King Addons for Elementor versions before 51.1.81 fail to enforce capability, post-status, or password checks when rende
Stored Cross-Site Scripting in the King Addons for Elementor WordPress plugin (versions up to and including 51.1.62) all
Authenticated stored cross-site scripting in the King Addons for Elementor WordPress plugin (versions up to and includin
Stored cross-site scripting in the King Addons for Elementor WordPress plugin (versions through 51.1.85) allows an authe
Unauthenticated insecure direct object reference (IDOR) in the King Addons for Elementor WordPress plugin at versions up
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today