CVE-2026-84896: CWE-79 Cross-Site Scripting (XSS) in King Addons for Elementor

The King Addons for Elementor WordPress plugin versions prior to 51.1.77 contain a stored cross-site scripting vulnerability (CWE-79). The vulnerability arises from improper escaping of a widget display-style setting, which is output directly into an HTML attribute. Users with Contributor or higher privileges can exploit this to store malicious JavaScript code that executes when any visitor views the affected page. This can lead to compromise of user sessions, data theft, or other malicious actions executed in the context of the victim's browser.

Successful exploitation allows an attacker with Contributor-level or higher privileges to execute arbitrary JavaScript in the browsers of any visitor to the affected page, including logged-in administrators. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the privileges of the victim user. The CVSS score of 6.8 reflects a medium severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher user permissions to trusted users only. Monitor for suspicious activity related to widget display-style settings. Avoid exposing affected pages to untrusted users.