CVE-2026-15284: King Addons Elementor Stored XSS Vulnerability (v51.1.62)

Technical summary

The vulnerability stems from two distinct input-handling flaws in King Addons for Elementor. First, the add_to_submissions() function sanitizes the 'form_page_id' parameter using sanitize_text_field(), which removes most HTML tags but preserves double-quote characters. This sanitized value is then stored in post metadata without additional encoding. Second, the king_addons_submissions_custom_column_content() function retrieves this stored value and concatenates it directly into an HTML href attribute through admin_url() without applying esc_url() or similar output-escaping functions. This combination allows a double-quote character followed by arbitrary JavaScript to break out of the href attribute context and execute within the page's DOM.

Business impact

Organizations running King Addons for Elementor face a persistent threat to administrator and editor accounts. An attacker with subscriber access can create a stored payload that executes every time an administrator views affected submission records, potentially leading to account compromise, unauthorized administrative actions, malware distribution, or data exfiltration. The attack requires no user interaction beyond routine admin panel access, making it a reliable persistence mechanism for a low-privileged attacker seeking to escalate influence within a WordPress installation.

Affected systems

King Addons for Elementor plugin versions up to and including 51.1.62 are affected. Any WordPress installation with this plugin active and users holding subscriber-level or higher permissions is at risk. The vulnerability affects both single-site and multisite WordPress deployments. Organizations should verify their installed version by checking the plugin's admin page or by inspecting the plugin folder directly.

Exploitability

Exploitability is moderate. An attacker must possess valid WordPress authentication credentials at the subscriber level or above—a common permission tier granted to form submitters, contributors, or authors. The attack is entirely self-service (no social engineering required) and requires only the ability to submit a form or trigger the vulnerable code path. No zero-day or advanced techniques are needed; basic knowledge of XSS and HTML attribute context is sufficient. However, the vulnerability is limited to authenticated users, which narrows the attack surface compared to unauthenticated XSS variants.

Remediation

Update King Addons for Elementor to a version newer than 51.1.62 as soon as a fix is available from the plugin vendor. In the interim, restrict subscriber-level access to users who genuinely require it, and audit existing subscribers and contributors to ensure no unauthorized accounts exist. Consider temporarily disabling the plugin if it is not actively in use or if high-value administrative accounts are at imminent risk. WordPress administrators should also monitor their site for signs of stored XSS exploitation, such as unexpected script tags in submission metadata or unusual admin activity.

Patch guidance

Monitor the King Addons for Elementor plugin repository and vendor communications for a patched version released after 51.1.62. Once available, apply the update through the WordPress admin dashboard (Plugins → Updates) or via your plugin management tool. Test the update in a staging environment first to ensure compatibility with your custom Elementor pages and forms. Verify that no stored XSS payloads remain in your database after patching by inspecting recent form submissions and post metadata. If the plugin maintainers release a patch, confirm that it implements both proper input sanitization (or rejection of dangerous characters) and output escaping at the display point using esc_url() or equivalent functions.

Detection guidance

Search your database for suspicious patterns in post meta associated with form submissions, particularly double-quote characters followed by common JavaScript event handlers (e.g., onclick=, onerror=, onload=) in the 'form_page_id' or related fields. Review administrator access logs and audit trails for unusual form submission activity or changes to post meta values. Use WordPress security plugins with XSS detection capabilities to flag stored scripts in metadata. Enable detailed logging in your WordPress installation and monitor for admin_url() functions being called with unsanitized output. Conduct a manual code review of any custom integrations with King Addons submissions to identify similar vulnerabilities.

Why prioritize this

Despite a CVSS score of 6.4 (Medium), this vulnerability warrants rapid prioritization because it affects administrator and editor interfaces directly, enabling a low-privileged attacker to compromise high-privileged accounts. Stored XSS in admin-facing functionality is particularly dangerous because it can persist indefinitely and execute every time an admin visits affected pages. The authentication requirement is low (subscriber level), and many WordPress sites grant subscriber access liberally. Organizations using King Addons for forms should treat this as a high priority in their patch cycle, especially if they have untrusted or semi-trusted users with subscriber permissions.

Risk score, explained

The CVSS 3.1 score of 6.4 (Medium) reflects a network-accessible vulnerability requiring low-privilege authentication, producing limited immediate impact (confidentiality and integrity compromise, no availability impact). However, the stored nature of the XSS, combined with its persistence in admin contexts, elevates real-world risk beyond the numeric score. The lack of user interaction at exploitation time (once a victim admin views the page) and the likelihood of exposure to high-privilege accounts justifies treating this as higher in organizational risk rankings than a typical CVSS 6.4 vulnerability.

Frequently asked questions