Cross-site scripting in kingaddons King Addons for Elementor – 80+ Elementor Widgets, 4…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The King Addons for Elementor plugin for WordPress is vulnerable to multiple Contributor+ DOM-Based Stored Cross-Site Scripting vulnerabilities in all versions up to, and including, 51.1.38. This is due to insufficient input sanitization and output escaping across multiple widgets and features. The plugin uses esc_attr() and esc_url() within JavaScript inline event handlers (onclick attributes), which allows HTML entities to be decoded by the DOM, enabling attackers to break out of the JavaScript context. Additionally, several JavaScript files use unsafe DOM manipulation methods (template literals, .html(), and window.location.href with unvalidated URLs) with user-controlled data. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via Elementor widget settings that execute when a user accesses the injected page or when an administrator previews the page in Elementor's editor. The vulnerability was partially patched in version 5.1.51.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kingaddons | King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder | up to 51.1.53 | — | No fix listed | CNA |
- King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder Vendorkingaddons Affected up to 51.1.53 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13535
- 2026-10-03 Alias added: GHSA-96wm-hfgm-fcxx
References
Other 11
- https://www.wordfence.com/threat-intel/vulnerabilities/id/95d3e76c-612d-436c-9d32-6228d7dcbf35?source=cve
- https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/assets/libraries/lightgallery/lightgallery.js
- https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Video_Popup/Video_Popup.php#L813
- https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Off_Canvas_Content/Off_Canvas_Content.php#L629
- https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Popup/Popup.php#L708
- https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/features/Wrapper_Link/Wrapper_Link.php#L85
- https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Pricing_Calculator/Pricing_Calculator.php#L1896
- https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Countdown/script.js#L119
- https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.38/includes/widgets/Image_Accordion/script.js#L141
- https://plugins.trac.wordpress.org/changeset/3438067/
- https://plugins.trac.wordpress.org/changeset/3441952/
More kingaddons vulnerabilities
- TI-2025-07770 Improper privilege management in kingaddons King Addons for Elementor – 4,000+ ready… CVSS 3.1CRITICAL 9.8
- TI-2026-39642 Authorization bypass in kingaddons Trinity Backup – Backup, Migrate, Restore, Clone… CVSS 3.1HIGH 7.5
- TI-2026-12861 Cross-site scripting in kingaddons King Addons for Elementor – 80+ Elementor Widgets, 4… CVSS 3.1MEDIUM 6.4
- TI-2025-12789 King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure CVSS 3.1MEDIUM 5.3
- TI-2026-64026 WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
- TI-2026-36134 WordPress King Addons for Elementor plugin <= 51.1.62 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-13535 · CVE Program
- CVE-2025-13535 · NVD
- FIRST EPSS
- GHSA-96wm-hfgm-fcxx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences