WordPress Plugin Vulnerabilities

King Addons for Elementor < 51.1.63 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
king-addons
Fixed in 51.1.63

References

CVE
CVE-2025-62887
URL
https://vdp.patchstack.com/database/Wordpress/Plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-37-cross-site-scripting-xss-vulnerability

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Abu Hurayra (HurayraIIT)
Verified
No
WPVDB ID
71da55fe-d243-45f5-8cf0-1931f5793552

Timeline

Publicly Published
2025-08-18 (about 1 year ago)
Added
2025-10-29 (about 9 months ago)
Last Updated
2026-07-09 (about 1 month ago)

Other

Published
Title
Published
2024-01-03
Title
Ads Invalid Click Protection <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-05-19
Title
Cost of Goods for WooCommerce < 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-06-05
Title
Advanced Woo Labels – Product Labels for WooCommerce < 1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-07
Title
Advanced Product Information for WooCommerce < 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-08-19
Title
Admin Menu Groups <= 0.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting