Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

CVE-2026-125444

WordPress King Addons for Elementor plugin <= 51.1.87 - Broken Access Control vulnerability

Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through 51.1.87.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kingaddons Wordpress-extensions
Products
King Addons For Elementor King Addons For Elementor
CVE-2026-84896

King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget

The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
King Addons For Elementor
CVE-2026-14841

King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget

The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
King Addons For Elementor
CVE-2026-84902

King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Kingaddons Wordpress-extensions
Products
King Addons For Elementor King Addons For Elementor
CVE-2026-84903

King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Kingaddons Wordpress-extensions
Products
King Addons For Elementor King Addons For Elementor
CVE-2026-84904

King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Kingaddons Wordpress-extensions
Products
King Addons For Elementor King Addons For Elementor