Junglewise Threat Intelligence

CVE-2026-15284: King Addons for Elementor Stored XSS in form_page_id parameter

CVE-2026-15284 · Severity: medium · CVSS 6.4 · Published 2026-07-10

Executive brief

The King Addons for Elementor plugin for WordPress, which provides additional design widgets and templates, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the website. An attacker with basic user access (such as a subscriber) can exploit this to run code in the browsers of other users, including administrators. This could lead to unauthorized actions being performed on the site or the theft of sensitive session information.

Technical details

The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping. The 'add_to_submissions()' function uses 'sanitize_text_field()', which fails to strip double-quote characters before storing data in post meta. Subsequently, the 'king_addons_submissions_custom_column_content()' function fails to escape this data when concatenating it into an HTML href attribute via 'admin_url()'. Authenticated attackers with subscriber-level permissions or higher can exploit this to inject arbitrary web scripts. These scripts execute whenever a user, such as an administrator, views the affected page in the WordPress dashboard. The issue is addressed in version 51.1.63.

Affected products

  • kingaddons King Addons for Elementor up to, and including, 51.1.62

Timeline

  • 2026-07-10: advisory: CVE published by Wordfence/NVD
  • 2026-07-10: disclosed
  • 2026-07-10: patched: Fixed in version 51.1.63

References