CVE-2026-84896— King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
Quick assessment
Affected
Unknown King Addons for Elementor
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
King Addons for Elementor WordPress 插件在 51.1.77 版本之前，在将小部件的显示样式设置输出到 HTML 属性时未进行转义，这使得拥有“Contributor”（贡献者）或更高权限的用户可以存储 JavaScript 代码，该代码会在访问受影响页面的任何访客（包括已登录的管理员）的浏览器中执行。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | King Addons for Elementor | < 51.1.77 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84896
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
Source: CVE Program / CVE List V5
Vulnerability Description
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | King Addons for Elementor | 0 ~ 51.1.77 | - |
|
II. Public POCs for CVE-2026-84896
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84896
请登录查看更多情报信息。
Exploits & Public PoCs for CVE-2026-84896 (1)
-
🔗 King Addons for Elementor < 51.1.77 – Contributor+ Stored XSS via Magazine Grid Widget | CVE 2026-84896 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-05 · 34 CVEs total
| CVE-2026-77826 | RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Fa | |
| CVE-2026-82304 | Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler | |
| CVE-2026-81424 | Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR | |
| CVE-2026-83543 | Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint | |
| CVE-2026-83544 | Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute | |
| CVE-2026-81423 | Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler | |
| CVE-2026-81348 | My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and | |
| CVE-2026-81404 | IPGP Visitors Origin < 1.6 - Reflected XSS | |
| CVE-2026-78362 | SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Au | |
| CVE-2026-82846 | Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields | |
| CVE-2026-78149 | Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_pas | |
| CVE-2026-78150 | Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure v | |
| CVE-2026-19861 | JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Em | |
| CVE-2026-15247 | Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deleti | |
| CVE-2026-19858 | JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure | |
| CVE-2025-15694 | Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS | |
| CVE-2025-15693 | JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal | |
| CVE-2026-84937 | YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax | |
| CVE-2026-84021 | Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_ | |
| CVE-2026-84022 | Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attribu |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: King Addons for Elementor
-
CVE-2026-66575
WordPress King Addons for Elementor plugin <= 51.1.81 - Inse -
CVE-2026-14841
King Addons for Elementor < 51.1.76 - Reflected XSS via Post -
CVE-2026-48870
WordPress King Addons for Elementor plugin <= 51.1.62 - Cros -
CVE-2025-6327
WordPress King Addons for Elementor plugin <= 51.1.36 - Arbi -
CVE-2025-6325
WordPress King Addons for Elementor plugin <= 51.1.36 - Priv
Same vendor: Unknown
-
CVE-2026-87831
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attac -
CVE-2026-87829
Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attac -
CVE-2026-91017
Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthen -
CVE-2026-86801
To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, Fi -
CVE-2026-87963
Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username
V. Comments for CVE-2026-84896
No comments yet