CVE-2026-84902 in King Addons for Elementor Plugin
Summary
by MITRE • 09/18/2026
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in King Addons for Elementor prior to version 51.1.81 represents a critical intersection of broken access control and insecure output handling, fundamentally compromising the integrity and security of WordPress sites utilizing this plugin. The core issue stems from an insufficient object-level authorization check during the template import process. In standard web application architecture, particularly within content management systems like WordPress, it is imperative that operations modifying specific resources verify not only the user's general role but also their ownership or explicit permission to modify the target resource. This flaw allows authenticated users with contributor-level access and above to bypass these restrictions entirely. By exploiting this gap in authorization logic, an attacker can import template content into pages they do not own, effectively overwriting the Elementor-generated layout and design of arbitrary posts and pages. This capability extends even to administrative-owned content, thereby undermining the hierarchical trust model inherent in WordPress user roles and allowing lower-privileged users to exert control over high-value assets managed by site administrators.
The operational impact of this vulnerability is severe due to its dual nature involving both data integrity compromise and code execution risks. The ability to overwrite arbitrary page content disrupts the intended presentation layer, potentially leading to defacement or misleading information delivery depending on the imported template's structure. More critically, the plugin fails to properly sanitize widget settings before rendering them in the browser context. This lack of output escaping creates a direct pathway for Stored Cross-Site Scripting. When an attacker imports a maliciously crafted template containing JavaScript payloads within specific widget configurations, this code is persisted in the database and subsequently executed whenever any user views the affected page. Unlike reflected XSS which requires immediate interaction with a crafted link, stored XSS persists on the server side, ensuring that every visitor to the compromised page becomes a potential victim without needing special triggers or social engineering beyond initial access.
From an industry standards perspective, this vulnerability maps directly to CWE-862 Missing Authorization and CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting. The failure to verify object ownership aligns with the principles outlined in OWASP Top 10 under Broken Access Control, where applications fail to restrict unauthorized access to functional endpoints or data objects. Furthermore, the persistence of malicious scripts via stored XSS corresponds to CWE-836 Use of a Password-based Secret for User Authentication if credentials are stolen through session hijacking facilitated by the script execution. The attack vector leverages ATT&CK technique T1059 Command and Scripting Interpreter, specifically JavaScript, allowing attackers to execute arbitrary commands within the victim's browser environment. This can lead to credential theft via keyloggers or cookie stealers, redirection to phishing sites, or further propagation of malware across the user base.
Mitigation strategies must address both the authorization logic flaw and the input sanitization deficiency immediately. The primary remediation is upgrading King Addons for Elementor to version 51.1.81 or later, where these specific checks have been implemented by the developers. For organizations unable to patch immediately due to compatibility concerns with other plugins, temporary mitigations should focus on restricting user capabilities that allow template imports and widget editing. Implementing a Web Application Firewall can provide some protection against XSS payloads but is not a substitute for proper code-level fixes since stored vulnerabilities reside in the database rather than just request parameters. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successfully injected scripts by restricting script execution sources. Regular auditing of user roles and permissions ensures that only trusted administrators have access to high-privilege actions such as global template management, reducing the attack surface available to lower-level contributors who might otherwise exploit this flaw.