# CVE-2026-84902: King Addons for Elementor contributor privilege escalation and stored XSS via template import

Source: https://junglewise.ai/threats/cve-2026-84902-king-addons-for-elementor-contributor-privilege-escalation-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-84902 · Severity: medium · CVSS 6.8 · Published 2026-09-18

The King Addons for Elementor WordPress plugin allows users with contributor-level permissions to import templates without proper authorization checks, enabling them to overwrite page content owned by administrators and inject malicious code. An attacker with contributor access can deface websites and execute JavaScript in the browsers of all visitors, including administrators, potentially leading to account compromise or malware distribution.

Technologies: [King Addons for Elementor](https://junglewise.ai/threats/technologies/king-addons-for-elementor). Vendors: [King Addons](https://junglewise.ai/threats/vendors/king-addons).

## Quick answers

**Is CVE-2026-84902 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84902 being exploited in the wild.

**How severe is CVE-2026-84902?** Medium severity, with a CVSS score of 6.8, published 18 September 2026.

**Which products and versions are affected?** King Addons for Elementor before 51.1.81.

**Is there a fix for CVE-2026-84902?** A patch was published on 2026-09-18: Fixed in version 51.1.81 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84902 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84902?** Check whether you run King Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a combination of missing object-level authorization and stored cross-site scripting (XSS). When a contributor-level user imports template content, the plugin does not verify they have permission to modify the target post or page, allowing overwrite of any Elementor content. Additionally, a widget setting in the template is output to the page without HTML escaping, permitting injection of arbitrary JavaScript. An attacker with contributor or higher role can exploit this via the template import functionality; no additional privileges or social engineering required. The malicious script executes server-side in the session context of any user viewing the affected page, including administrators. The vulnerability is patched in version 51.1.81.

## Affected products

- King Addons King Addons for Elementor before 51.1.81

## Timeline

- 2026-09-16: disclosed
- 2026-09-18: patched: Fixed in version 51.1.81

## References

- [https://wpscan.com/vulnerability/4afc5f30-8b30-4e77-9bd7-91c25065bb54/](https://wpscan.com/vulnerability/4afc5f30-8b30-4e77-9bd7-91c25065bb54/)

## Related threats

- [King Addons for Elementor broken access control vulnerability](https://junglewise.ai/threats/cve-2026-125444-missing-authorization-vulnerability-in-king-addons-king-addons)
- [King Addons for Elementor reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-97298-contributor-cross-site-scripting-xss-in-king-addons-for-elementor)
- [King Addons for Elementor stored cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-96835-contributor-cross-site-scripting-xss-in-king-addons-for-elementor)
- [King Addons for Elementor missing authorization in image optimizer](https://junglewise.ai/threats/cve-2026-84904-king-addons-for-elementor-missing-authorization-in-image)
- [King Addons for Elementor information disclosure via kng_maintenance_page shortcode](https://junglewise.ai/threats/cve-2026-84903-king-addons-for-elementor-information-disclosure-via-kng)