Veille CVE

Recherche « KingAddons King Addons for Elementor »

4 CVE

Critique 0 Élevée 0 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « KingAddons King Addons for Elementor » ✕
  1. CVE-2026-97298 6.5 Moyenne

    KingAddons King Addons for Elementor

    Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.

  2. CVE-2026-96835 6.5 Moyenne

    KingAddons.com King Addons for Elementor

    Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.

  3. CVE-2026-66575 5.3 Moyenne

    KingAddons.com King Addons for Elementor

    Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.

  4. CVE-2026-15284 6.4 Moyenne

    kingaddons King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder

    The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to, and including, 51.1.62 This is due to insufficient input sanitization in the add_to_submissions() function, which applies sanitize_text_field() (which preserves double-quote characters) before storing the value in post meta, combined with missing output escaping in the king_addons_submissions_custom_column_content() function, which concatenates the stored value into an HTML href attribute via admin_url() without wrapping the result in esc_url(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.