CVE-2026-84896 — King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget

CVE-2026-84896

King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget PUBLISHED

Description (CNA)

The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.

Affected (CNA)

Vendor / product	Versions
Unknown / King Addons for Elementor	affected 0 before 51.1.77

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fe9ac024-53dc-48a3-99c8-1ec97c84c959/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.