CVE-2026-96835: WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability
Published Sep 30, 2026
·Updated
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.
Affected Software
1 affected component
King Addons King Addons for Elementor<=51.1.85
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress King Addons for Elementor pluginto a version that resolves this vulnerability.Fixed in 51.1.86
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs Contributor-level privileges in WordPress. Exploitation also requires user interaction.
2
What versions are affected?
King Addons for Elementor versions 51.1.85 and earlier are affected.
3
What is the potential impact?
Successful exploitation can lead to cross-site scripting, with low impact to confidentiality, integrity, and availability. The scope is changed.