EUVD-2026-42793
GHSA-h683-9pfq-8v3c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UI:R assessed because payload fires only when a privileged admin visits the submissions admin page, not passively; all other metrics match the attack profile.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to, and including, 51.1.62 This is due to insufficient input sanitization in the add_to_submissions() function, which applies sanitize_text_field() (which preserves double-quote characters) before storing the value in post meta, combined with missing output escaping in the king_addons_submissions_custom_column_content() function, which concatenates the stored value into an HTML href attribute via admin_url() without wrapping the result in esc_url(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in King Addons for Elementor (WordPress plugin, versions ≤51.1.62) allows authenticated attackers with subscriber-level access to inject persistent JavaScript into the WordPress admin submissions panel. The flaw stems from a two-stage sanitization failure: sanitize_text_field() applied during form submission storage preserves double-quote characters in form_page_id, and the downstream king_addons_submissions_custom_column_content() function then concatenates that stored value into an HTML href attribute via admin_url() without wrapping the result in esc_url(). No public exploit or CISA KEV listing exists at time of analysis; EPSS data was not provided in the input.
Technical ContextAI
The vulnerability resides in the Form Builder widget of King Addons for Elementor, a WordPress page-builder plugin extending Elementor. The affected code path spans two PHP helper files: Create_Submission.php (which handles form submission processing) and View_Submissions_Pro.php (which renders stored submissions in the WordPress admin). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), specifically arising from mismatched sanitization: sanitize_text_field() is designed to strip tags and certain special characters but intentionally preserves double-quote (") characters, making it unsuitable as a security boundary before outputting values into HTML attribute contexts. The admin_url() function constructs a URL but does not sanitize its inputs; without esc_url() wrapping the output, an attacker-controlled double-quote can break out of the href attribute and inject an event handler or javascript: URI. CPE data was not explicitly provided, but the plugin is identified by its WordPress plugin repository slug king-addons.
RemediationAI
Vendor-released patch: 51.1.63. Update the King Addons for Elementor plugin to version 51.1.63 or later immediately via the WordPress admin dashboard (Plugins → Updates) or via WP-CLI (wp plugin update king-addons). The fix is confirmed in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset/3537725. If immediate patching is not possible, the most effective compensating control is to disable subscriber-level (and other low-privilege) user registration on the affected WordPress site under Settings → General → uncheck 'Anyone can register', which removes the attacker's ability to obtain the required authentication credential. As a secondary control, restrict access to the WordPress admin submissions view (/wp-admin/admin.php?page=king-addons-submissions) via web server rules or a WAF rule targeting that endpoint, though this does not prevent the injection itself. Note that disabling registration may impact legitimate site workflows requiring self-service accounts. Wordfence threat intelligence entry: https://www.wordfence.com/threat-intel/vulnerabilities/id/349ba9de-69b3-42fb-aeba-c3a24280547f.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today