King Addons For Elementor
Monthly
Authenticated stored cross-site scripting in the King Addons for Elementor WordPress plugin (versions up to and including 51.1.86) allows an attacker holding a Contributor-level account to inject a script payload through an insufficiently sanitized addon widget or field, which then executes in the trusted wp-admin origin when a higher-privileged user (editor or administrator) views or previews the affected content. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires both an authenticated Contributor account (PR:L) and victim interaction (UI:R), so it is not remotely exploitable by anonymous visitors and does not self-execute. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vulnerability was reported via Patchstack's WordPress plugin disclosure channel.
Stored cross-site scripting in the King Addons for Elementor WordPress plugin (versions through 51.1.85) allows an authenticated attacker with Contributor-level privileges or higher to inject JavaScript that executes in the browser of a higher-privileged user - typically an administrator - who views or previews the crafted content. Exploitation requires an existing low-privilege account plus a separate, subsequent user-interaction step (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and the scope change (S:C) reflects that the script runs with the victim's privileges rather than the attacker's, enabling session or content tampering in an administrative context. This is a moderate-risk, real-world-low-priority issue: there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Missing per-object authorization checks in the King Addons for Elementor WordPress plugin (affected range 51.1.56 through versions before 51.1.81) allow an authenticated user holding at least the WordPress 'author' role to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media files belonging to other users, including administrator-owned media. The plugin's image-optimization actions gate access only on a coarse capability that authors already possess and never verify ownership of the targeted attachment, so no user interaction or non-default configuration is required beyond having the plugin active. Exploitation is bounded by the authenticated author-level prerequisite, but publicly available exploit code exists and a vendor patch (51.1.81) is available, so sites that issue author accounts to untrusted or numerous users - multi-author blogs, membership and community sites - should treat this as a genuine but lower-tier priority to remediate promptly.
King Addons for Elementor versions before 51.1.81 fail to enforce capability, post-status, or password checks when rendering the content of a requested post, allowing any authenticated user with Contributor-level access or higher to read the contents of private, draft, pending, and password-protected posts they are not authorized to view. The flaw is an authenticated information-disclosure issue (CWE-200) that requires only an active contributor-level account on a site running the affected plugin plus the choice of a target post ID; it grants no write, modification, or destructive capability. Publicly available exploit code exists, but there is no indication of confirmed active exploitation and the vendor has shipped a fix in 51.1.81; our independent assessment rates this a genuinely low-priority, though real and patch-worthy, authorization flaw (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Stored cross-site scripting and unauthorized content tampering in the King Addons for Elementor WordPress plugin (all versions before 51.1.81) allow authenticated users with contributor-level access or above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, because the template-import feature performs no object-level authorization check. A widget setting is written to the page and rendered without escaping, so the injected JavaScript executes in the session of any user who later views the tampered page. Publicly available exploit code exists and the vendor has released a fixed version (51.1.81); there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.
Unauthenticated insecure direct object reference (IDOR) in the King Addons for Elementor WordPress plugin at versions up to and including 51.1.81 lets remote attackers manipulate objects belonging to other users or site roles by supplying a crafted object identifier to an affected endpoint, with no authentication or user interaction required (CVSS 5.3, AV:N/AC:L/PR:N/UI:N). Impact is deliberately narrow: only Low integrity is affected (I:L), with no confidentiality or availability loss and no scope change, so the practical worst case is unauthorized modification of a single object rather than data theft or site takeover. No public exploit has been identified at time of analysis, and the issue is reported through Patchstack; no vendor-released fixed version is published as of this assessment, so mitigation currently depends on virtual patching or deactivating the plugin.
Stored cross-site scripting in King Addons for Elementor WordPress plugin before version 51.1.77 allows any Contributor-level (or higher) user to inject persistent JavaScript into a widget display-style setting that is written unescaped into an HTML attribute at render time. The payload fires in every visitor's browser upon page load - including logged-in administrators - enabling session hijacking, credential theft, or silent execution of privileged site actions. A publicly available proof-of-concept was disclosed via WPScan; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Reflected XSS in King Addons for Elementor (all versions before 51.1.76) permits unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in an unsanitized grid setting parameter reflected verbatim into an HTML attribute via an unauthenticated AJAX endpoint. The attack requires social engineering to deliver a crafted URL to a target user, with no privilege or authentication prerequisite on the server side. A publicly available exploit exists per WPScan; exploitation is not confirmed in CISA KEV, and EPSS at 0.17% (7th percentile) indicates limited observed exploitation at this time.
Stored Cross-Site Scripting in the King Addons for Elementor WordPress plugin (versions up to and including 51.1.62) allows authenticated subscribers to inject and persist malicious JavaScript payloads within plugin-rendered content. The scope-changed CVSS vector (S:C) reflects that injected scripts execute in the browsers of other site users - including administrators - enabling session hijacking and privilege escalation via social engineering. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the moderate-priority tier despite the network-reachable attack surface.
Authenticated stored cross-site scripting in the King Addons for Elementor WordPress plugin (versions up to and including 51.1.86) allows an attacker holding a Contributor-level account to inject a script payload through an insufficiently sanitized addon widget or field, which then executes in the trusted wp-admin origin when a higher-privileged user (editor or administrator) views or previews the affected content. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires both an authenticated Contributor account (PR:L) and victim interaction (UI:R), so it is not remotely exploitable by anonymous visitors and does not self-execute. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vulnerability was reported via Patchstack's WordPress plugin disclosure channel.
Stored cross-site scripting in the King Addons for Elementor WordPress plugin (versions through 51.1.85) allows an authenticated attacker with Contributor-level privileges or higher to inject JavaScript that executes in the browser of a higher-privileged user - typically an administrator - who views or previews the crafted content. Exploitation requires an existing low-privilege account plus a separate, subsequent user-interaction step (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), and the scope change (S:C) reflects that the script runs with the victim's privileges rather than the attacker's, enabling session or content tampering in an administrative context. This is a moderate-risk, real-world-low-priority issue: there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Missing per-object authorization checks in the King Addons for Elementor WordPress plugin (affected range 51.1.56 through versions before 51.1.81) allow an authenticated user holding at least the WordPress 'author' role to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media files belonging to other users, including administrator-owned media. The plugin's image-optimization actions gate access only on a coarse capability that authors already possess and never verify ownership of the targeted attachment, so no user interaction or non-default configuration is required beyond having the plugin active. Exploitation is bounded by the authenticated author-level prerequisite, but publicly available exploit code exists and a vendor patch (51.1.81) is available, so sites that issue author accounts to untrusted or numerous users - multi-author blogs, membership and community sites - should treat this as a genuine but lower-tier priority to remediate promptly.
King Addons for Elementor versions before 51.1.81 fail to enforce capability, post-status, or password checks when rendering the content of a requested post, allowing any authenticated user with Contributor-level access or higher to read the contents of private, draft, pending, and password-protected posts they are not authorized to view. The flaw is an authenticated information-disclosure issue (CWE-200) that requires only an active contributor-level account on a site running the affected plugin plus the choice of a target post ID; it grants no write, modification, or destructive capability. Publicly available exploit code exists, but there is no indication of confirmed active exploitation and the vendor has shipped a fix in 51.1.81; our independent assessment rates this a genuinely low-priority, though real and patch-worthy, authorization flaw (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Stored cross-site scripting and unauthorized content tampering in the King Addons for Elementor WordPress plugin (all versions before 51.1.81) allow authenticated users with contributor-level access or above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, because the template-import feature performs no object-level authorization check. A widget setting is written to the page and rendered without escaping, so the injected JavaScript executes in the session of any user who later views the tampered page. Publicly available exploit code exists and the vendor has released a fixed version (51.1.81); there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.
Unauthenticated insecure direct object reference (IDOR) in the King Addons for Elementor WordPress plugin at versions up to and including 51.1.81 lets remote attackers manipulate objects belonging to other users or site roles by supplying a crafted object identifier to an affected endpoint, with no authentication or user interaction required (CVSS 5.3, AV:N/AC:L/PR:N/UI:N). Impact is deliberately narrow: only Low integrity is affected (I:L), with no confidentiality or availability loss and no scope change, so the practical worst case is unauthorized modification of a single object rather than data theft or site takeover. No public exploit has been identified at time of analysis, and the issue is reported through Patchstack; no vendor-released fixed version is published as of this assessment, so mitigation currently depends on virtual patching or deactivating the plugin.
Stored cross-site scripting in King Addons for Elementor WordPress plugin before version 51.1.77 allows any Contributor-level (or higher) user to inject persistent JavaScript into a widget display-style setting that is written unescaped into an HTML attribute at render time. The payload fires in every visitor's browser upon page load - including logged-in administrators - enabling session hijacking, credential theft, or silent execution of privileged site actions. A publicly available proof-of-concept was disclosed via WPScan; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
Reflected XSS in King Addons for Elementor (all versions before 51.1.76) permits unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in an unsanitized grid setting parameter reflected verbatim into an HTML attribute via an unauthenticated AJAX endpoint. The attack requires social engineering to deliver a crafted URL to a target user, with no privilege or authentication prerequisite on the server side. A publicly available exploit exists per WPScan; exploitation is not confirmed in CISA KEV, and EPSS at 0.17% (7th percentile) indicates limited observed exploitation at this time.
Stored Cross-Site Scripting in the King Addons for Elementor WordPress plugin (versions up to and including 51.1.62) allows authenticated subscribers to inject and persist malicious JavaScript payloads within plugin-rendered content. The scope-changed CVSS vector (S:C) reflects that injected scripts execute in the browsers of other site users - including administrators - enabling session hijacking and privilege escalation via social engineering. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the moderate-priority tier despite the network-reachable attack surface.