Executive brief
King Addons for Elementor is a WordPress plugin that provides advanced widgets for the Elementor page builder, including a Posts Grid widget. The plugin fails to properly escape user-supplied input in the grid settings before displaying it in HTML attributes, allowing attackers to inject and execute malicious JavaScript code. An unauthenticated attacker can trick visitors into loading a specially crafted page and steal session data, redirect users, or perform actions on behalf of the victim.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the king_addons_filter_grid_posts AJAX action. The plugin accepts user-supplied grid settings, specifically the overlay_animation parameter, and reflects it unsanitized into an HTML class attribute. The AJAX endpoint is reachable without authentication and uses a nonce that is publicly exposed in pages containing the Posts Grid widget. An attacker can craft a malicious POST request with an injected payload (e.g., `"><img src=x onerror=alert()>`) that breaks out of the class attribute and executes arbitrary JavaScript in the victim's browser. The vulnerability was patched in version 51.1.76.
Affected products
- King Addons King Addons for Elementor before 51.1.76
Timeline
- 2026-07-20: disclosed
- 2026-08-02: published