CVE-2026-96835 in King Addons Plugin
Summary
by MITRE • 09/30/2026
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as Contributor Cross-Site Scripting within the King Addons plugin for WordPress, specifically affecting versions up to and including 51.1.85, represents a significant security risk stemming from insufficient input validation and output encoding mechanisms. This flaw allows authenticated users with lower-level privileges, such as contributors or subscribers, to inject malicious client-side scripts into web pages viewed by other users. The root cause lies in the plugin's failure to properly sanitize user-supplied data before it is rendered within the admin interface or public-facing content areas managed through Elementor page builder templates. By exploiting this weakness, an attacker can bypass standard privilege restrictions inherent in WordPress role-based access control models, effectively elevating their impact beyond what their account permissions should theoretically allow.
From a technical perspective, the vulnerability typically manifests when user input is reflected directly into HTML output without adequate encoding of special characters such as quotes, ampersands, and angle brackets. When an attacker crafts a payload containing JavaScript code, often encapsulated within event handlers or script tags, this malicious content executes in the context of the victim's browser session upon page load. This execution occurs under the same origin policy, granting the injected scripts full access to cookies, local storage, and DOM elements associated with the WordPress administration dashboard or the specific website being targeted. The lack of proper Content Security Policy enforcement within the affected plugin environment further exacerbates this risk by allowing unrestricted script execution from untrusted sources.
The operational impact of this vulnerability is severe due to its potential for session hijacking and administrative takeover. An attacker can steal authentication cookies, thereby impersonating legitimate users or even administrators if they manage to escalate privileges through subsequent attacks. This capability facilitates unauthorized access to sensitive site data, including customer information, financial records, and proprietary content. Furthermore, the injected scripts can perform actions on behalf of the victim without their knowledge, such as modifying page settings, creating new admin accounts, or defacing the website's appearance. In enterprise environments, this could lead to significant reputational damage, regulatory non-compliance regarding data protection standards like GDPR or CCPA, and potential financial losses resulting from fraud or service disruption.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-79, which classifies improper neutralization of input during web page generation as a primary category for cross-site scripting flaws. Additionally, it maps to the MITRE ATT&CK framework technique T1059.007, specifically JavaScript execution within browser environments, and potentially T1078 if used to maintain persistent access through session manipulation. The exploitation vector is generally classified under Remote Code Execution via Input Validation Failure, highlighting the critical need for robust sanitization practices in all user-facing inputs regardless of perceived trust levels.
Mitigation strategies must prioritize immediate patching by upgrading King Addons and Elementor to versions that address these specific input validation gaps. Administrators should also implement strict Content Security Policy headers to restrict script execution sources where possible, although this is a compensating control rather than a fix for the underlying code defect. Regular security audits focusing on role-based access controls and output encoding are essential to prevent similar issues in custom themes or plugins. For organizations unable to patch immediately due to compatibility constraints, implementing Web Application Firewall rules that detect and block common XSS payloads can provide temporary protection against exploitation attempts while maintaining operational continuity until a permanent solution is deployed.