CVE-2026-97298 in King Addons Plugin
Summary
by MITRE • 09/30/2026
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as a Contributor-level Cross-Site Scripting issue within the King Addons plugin for WordPress, specifically affecting versions up to and including 51.1.86, represents a significant security risk in environments where multiple user roles are utilized. This flaw stems from insufficient input validation and output encoding mechanisms when handling data submitted by users with Contributor privileges. In typical WordPress configurations, Contributors have the ability to create and edit their own posts but generally lack access to administrative functions or other users' content. However, due to this specific implementation error within King Addons, a malicious actor operating under this limited role can inject untrusted script code into web pages viewed by other users, including administrators or editors who may interact with the affected content.
From a technical perspective, the vulnerability likely resides in how the plugin processes and renders user-generated input fields that are intended for post metadata or custom field entries associated with King Addons elements. When these inputs are reflected back to the browser without proper sanitization against special characters such as angle brackets, quotes, and ampersands, they allow for the execution of arbitrary JavaScript within the context of the victim's session. This aligns directly with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The lack of adequate encoding ensures that any script payload embedded in the input is interpreted by the browser as executable code rather than plain text data.
The operational impact of this vulnerability extends beyond simple defacement or alert boxes, which are often associated with low-severity XSS flaws. Because attackers can execute scripts within the context of authenticated sessions, they potentially gain the ability to perform actions on behalf of other users if those users have higher privileges. This could include stealing session cookies via document.cookie access, redirecting victims to phishing sites, or manipulating the DOM to alter the appearance and functionality of the site interface. In a multi-author blog or corporate intranet setup powered by WordPress, this undermines the principle of least privilege, as a lower-level user can effectively compromise higher-privileged accounts through social engineering tactics that lure them into viewing maliciously crafted content.
This vulnerability maps closely to MITRE ATT&CK technique T1059, specifically subtechnique 007 which covers JavaScript execution within web browsers. It also relates to the initial access and persistence phases of an attack chain if combined with other vectors such as stored XSS where the payload remains on the server for extended periods. The presence of this flaw indicates a gap in the plugin's security architecture regarding role-based capability checks during data processing, rather than just at the point of entry or administrative action validation.
To mitigate this risk, immediate updates to King Addons version 51.1.87 or later are strongly recommended as these versions typically include patches for previously disclosed input handling issues. Administrators should verify that all plugins in their WordPress ecosystem are up to date and configured with the latest security standards. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by filtering out malicious payloads before they reach the application logic. For developers maintaining custom integrations or forks of such plugins, it is essential to enforce strict output encoding using functions like esc_html or wp_kses_post when rendering user-supplied data in HTML contexts, ensuring that special characters are converted into their corresponding HTML entities and preventing browser interpretation as executable code.