rootpwn

medium · CVSS v3 5.4

CVE-2026-84902

The King Addons for Elementor WordPress plugin (v<51.1.81) lacks object-level authorization during template import, allowing contributor-lev

Overview

The King Addons for Elementor WordPress plugin (v<51.1.81) lacks object-level authorization during template import, allowing contributor-level users to overwrite any post or page content. This flaw also permits injection of unescaped JavaScript via widget settings, leading to stored XSS that affects all visitors to the compromised page. The vulnerability can compromise confidentiality, integrity, and availability of site content and user sessions.

Description

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.

Impact

Confidentiality: attackers can read or modify page content. Integrity: arbitrary content replacement and script injection alter page behavior. Availability: repeated XSS can degrade user experience. The flaw primarily impacts site administrators, editors, and any users who view affected pages.

Remediation

Update King Addons for Elementor to version 51.1.81 or later. If update is not possible, restrict contributor-level access or disable the template import feature. Additionally, sanitize widget settings and enforce proper escaping on output. Monitor site logs for unauthorized content changes.

Risk context

Medium severity (CVSS 5.4). No EPSS data available. The vulnerability is exploitable by users with contributor-level access, making it a moderate risk that should be addressed promptly.

Affected products

  • King Addons for Elementor
  • WordPress
  • Elementor plugin

Scores

Severity
medium
CVSS v2
3.5
CVSS v3
5.4
CVSS v4
—
EPSS
—

wordpress plugin xss authorization content-manipulation king-addons elementor

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-77164

A blind Server-Side Request Forgery vulnerability exists in the Nextcloud Circles app remote-instance signature verification process. Unauthenticated endpoints allow attackers to force the server to issue GET requests to arbitrary internal addresses before trust is established. While response bodies are not returned, this flaw enables internal network reconnaissance and service discovery.

View analysis

medium

CVE-2026-77170

An access control vulnerability exists in the Deck config API that permits authenticated users to modify board-scoped configuration keys for arbitrary board IDs. The issue stems from a lack of validation regarding whether the user owns or holds permissions to manage the targeted board. This matters because it enables unauthorized configuration tampering across organizational boundaries within the application.

View analysis

medium

CVE-2026-82980

An improper authorization vulnerability exists in the WebDAV plugin where absolute request URIs are resolved without validating user ownership. Any authenticated user can lock or unlock files belonging to other users, leading to denial of service or unauthorized modification control. This issue matters because it impacts data integrity and availability in multi-tenant or shared file environments.

View analysis