Executive brief
King Addons for Elementor is a popular WordPress plugin that extends the Elementor page builder with additional widgets. The plugin fails to properly escape user input in widget display-style settings, allowing contributors and higher-level users to inject malicious JavaScript that executes for all visitors, including administrators. This could lead to account compromise, data theft, or malware distribution from compromised website pages.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Magazine Grid and Taxonomy widgets' "Select Styling" settings. The vulnerable component fails to escape HTML special characters before rendering the setting value in an HTML class attribute. An attacker with Contributor-level access or above can craft a malicious payload (e.g., zz" onmouseover="alert(document.domain)" data-ka="X) that bypasses the select control's option validation and saves to the database. When the affected page is viewed, the payload breaks out of the class attribute context and executes arbitrary JavaScript in the visitor's browser. No authentication bypass is required for exploitation—only a valid Contributor account and network access to the WordPress admin interface. Patch available in version 51.1.77.
Affected products
- King Addons King Addons for Elementor before 51.1.77
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 51.1.77