King Addons for Elementor < 51.1.77 – Contributor+ Stored XSS via Magazine Grid Widget | CVE 2026-84896

Description

The plugin does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page, including logged-in administrators.

Proof of Concept

The PoC will be displayed on September 17, 2026, to give users the time to update.

Affects Plugins

king-addons

Fixed in 51.1.77

References

CVE

CVE-2026-84896

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

6.8 (medium)

Miscellaneous

Original Researcher

Revanth Hari Narayana Matte

Submitter

Revanth Hari Narayana Matte

Verified

Yes

WPVDB ID

fe9ac024-53dc-48a3-99c8-1ec97c84c959

Timeline

Publicly Published

2026-09-03 (about 2 days ago)

Added

2026-09-03 (about 1 day ago)

Last Updated

2026-09-03 (about 1 day ago)

Other

Published

Title

Published

2021-08-16

Title

SP Project & Document Manager < 4.26 - Reflected Cross-Site Scripting

Published

2024-02-14

Title

Premium Addons for Elementor < 4.10.19 - Contributor+ Stored Cross-Site Scripting

Published

2023-03-14

Title

Modern Events Calendar lite < 6.5.2 - Admin+ Stored XSS

Published

2023-12-28

Title

WP Tabs < 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2022-10-31

Title

AFS Analytics <= 4.22 - Admin+ Stored XSS