Veille CVE

Recherche « King Addons for Elementor »

15 CVE

Critique 0 Élevée 1 Moyenne 11 Faible 3 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « King Addons for Elementor » ✕
  1. CVE-2026-110537 3.8 Faible

    Unknown Essential Addons for Elementor

    The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval feature, checking only a site-level capability, which on WordPress Multisite could allow a subsite administrator to change the approval and login state of accounts belonging to other sites on the network.

  2. CVE-2026-97298 6.5 Moyenne

    KingAddons King Addons for Elementor

    Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.

  3. CVE-2026-96835 6.5 Moyenne

    KingAddons.com King Addons for Elementor

    Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.

  4. CVE-2026-84904 3.8 Faible

    Unknown King Addons for Elementor

    The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.

  5. CVE-2026-84903 2.7 Faible

    Unknown King Addons for Elementor

    The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.

  6. CVE-2026-84902 6.8 Moyenne

    Unknown King Addons for Elementor

    The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.

  7. CVE-2026-66575 5.3 Moyenne

    KingAddons.com King Addons for Elementor

    Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.

  8. CVE-2026-84896 6.8 Moyenne

    Unknown King Addons for Elementor

    The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.

  9. CVE-2026-13404 5.3 Moyenne

    Unknown Royal Addons for Elementor

    The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonce) before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that metadata on any post, including private and draft posts.

  10. CVE-2026-14841 6.1 Moyenne

    Unknown King Addons for Elementor

    The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.

  11. CVE-2026-15284 6.4 Moyenne

    kingaddons King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder

    The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to, and including, 51.1.62 This is due to insufficient input sanitization in the add_to_submissions() function, which applies sanitize_text_field() (which preserves double-quote characters) before storing the value in post meta, combined with missing output escaping in the king_addons_submissions_custom_column_content() function, which concatenates the stored value into an HTML href attribute via admin_url() without wrapping the result in esc_url(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  12. CVE-2026-48870 6.5 Moyenne

    King Addons for Elementor

    Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.

  13. CVE-2026-4024 5.3 Moyenne

    wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor

    The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wpr_update_form_action_meta` AJAX action in all versions up to, and including, 1.7.1056. The handler is registered on both `wp_ajax` and `wp_ajax_nopriv` hooks, making it accessible to unauthenticated users. Although a nonce is verified, the nonce (`wpr-addons-js`) is publicly exposed in frontend JavaScript via `WprConfig.nonce` on any page that loads Royal Addons widgets, rendering the protection ineffective. The endpoint also lacks any capability or ownership checks and directly calls `update_post_meta()` with user-controlled input on a whitelisted set of form action meta keys. This makes it possible for unauthenticated attackers to modify form action configuration metadata (email, submissions, Mailchimp, and webhook settings) on any post, potentially leading to webhook/email action tampering and data exfiltration via modified webhook URLs.

  14. CVE-2026-6229 7.2 Élevée

    wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor

    The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the render_csv_data() function, which can be bypassed by including 'docs.google.com/spreadsheets' in a query parameter, and the subsequent use of these URLs in fopen() calls without blocking internal or private network addresses. This makes it possible for authenticated attackers, with Contributor-level access and above, to make requests to arbitrary URLs and retrieve sensitive information from internal services.

  15. CVE-2024-13362 6.1 Moyenne

    sebet Go Fetch Jobs (for WP Job Manager) · 5starplugins Dynamic Copyright Year · peterschulznl Code Manager · bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior

    Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.