CVE-2026-84896 in King Addons for Elementor Plugin
Summary
by MITRE • 09/05/2026
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in King Addons for Elementor prior to version 51.1.77 represents a significant security flaw within the WordPress plugin ecosystem, specifically categorized as an Stored Cross-Site Scripting issue. This type of vulnerability is formally recognized under CWE-83, which defines stored XSS as occurring when malicious scripts are permanently stored on target servers, such as in databases or message boards, and subsequently delivered to users without proper validation. The core technical flaw lies in the plugin's handling of widget display-style settings. When a user configures these settings through the WordPress admin interface, the input data is not adequately sanitized or escaped before being embedded directly into HTML attributes within the generated page markup. This lack of output encoding allows an attacker to inject arbitrary JavaScript code that becomes part of the static content served to visitors.
The operational impact of this vulnerability is severe due to its persistence and broad reach. Unlike reflected XSS, which requires a user to click on a specially crafted link, stored XSS persists in the database or file system. Consequently, every time an affected page is loaded by any visitor, including administrators with high-level privileges, the malicious script executes automatically within their browser context. This allows attackers to perform actions such as stealing session cookies, hijacking administrative sessions, defacing websites, or redirecting users to phishing sites. The ability for contributors and above to exploit this means that even lower-privileged accounts can compromise the entire site's security posture by injecting payloads that affect all subsequent visitors.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers JavaScript execution in web browsers. The attack vector typically involves an attacker logging into the WordPress dashboard as a contributor or higher role user and utilizing the King Addons widget editor to insert malicious code within the style attributes of a page element. Once saved, this payload is stored server-side. When any client requests that specific page, the browser parses the HTML, encounters the unescaped script tag or event handler attribute containing the injected JavaScript, and executes it in the context of the current domain. This bypasses same-origin policy protections because the malicious code originates from a trusted source, making detection by standard security filters more difficult.
Mitigation strategies for this vulnerability are straightforward but require immediate action. The primary remediation is to upgrade the King Addons plugin to version 51.1.77 or later, where the developers have implemented proper input validation and output escaping mechanisms. Developers should ensure that all dynamic content inserted into HTML attributes is passed through appropriate sanitization functions such as esc_attr in WordPress environments. This ensures that special characters are converted to their corresponding HTML entities, preventing them from being interpreted as executable code by the browser. Additionally, implementing a Content Security Policy can provide an additional layer of defense by restricting the sources from which scripts can be loaded and executed, thereby mitigating the impact even if similar vulnerabilities exist in other plugins or themes on the same server.