King Addons for Elementor: known security problems
19 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.
Updated
In short
There are 19 known security problems on this page. Each one has a fixed version. Updating to version 51.1.87 or newer covers every fixed problem listed here.
Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.
Get an email when your site is affected: install Watchfox AI (free)
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 51.1.86)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.86
- Fixed in
- 51.1.87
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.87 or newer.
- Official ID
- CVE-2026-97298
- Report title
- King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.86 - Authenticated (Contributor+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 51.1.85)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.85
- Fixed in
- 51.1.86
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.86 or newer.
- Official ID
- CVE-2026-96835
- Report title
- King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.85 - Authenticated (Contributor+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
A stranger could use it to harm your site (up to and including 51.1.81)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.81
- Fixed in
- 51.1.82
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.82 or newer.
- Official ID
- CVE-2026-66575
- Report title
- King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.81 - Unauthenticated Insecure Direct Object Reference
- First reported
- Sources
- Wordfence, seen
Someone could do things on your site they should not be allowed to (up to and including 51.1.80)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.80
- Fixed in
- 51.1.81
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.81 or newer.
- Official ID
- CVE-2026-84904
- Report title
- King Addons for Elementor 51.1.56 - 51.1.80 - Missing Authorization
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could use it to harm your site
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.80
- Fixed in
- 51.1.81
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.81 or newer.
- Official ID
- CVE-2026-84903
- Report title
- King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Information Exposure
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 51.1.80)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.80
- Fixed in
- 51.1.81
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.81 or newer.
- Official ID
- CVE-2026-84902
- Report title
- King Addons for Elementor <= 51.1.80 - Authenticated (Contributor+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 51.1.77)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Before 51.1.77
- Fixed in
- 51.1.77
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.77 or newer.
- Official ID
- CVE-2026-84896
- Report title
- King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder < 51.1.77 - Authenticated (Contributor+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Someone could use it to harm your site
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.75
- Fixed in
- 51.1.76
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.76 or newer.
- Official ID
- CVE-2026-14841
- Report title
- King Addons for Elementor <= 51.1.75 - Reflected XSS via Posts Grid Widget
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 51.1.62)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.62
- Fixed in
- 51.1.63
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.63 or newer.
- Official ID
- CVE-2026-15284
- Report title
- King Addons for Elementor <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter
- First reported
- Sources
- Wordfence, seen
Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 51.1.62) (2)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.62
- Fixed in
- 51.1.63
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.63 or newer.
- Official ID
- CVE-2026-48870
- Report title
- King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 51.1.53)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.53
- Fixed in
- 51.1.54
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.54 or newer.
- Official ID
- CVE-2025-13535
- Report title
- King Addons for Elementor <= 51.1.38 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets
- First reported
- Sources
- Wordfence, seen
A stranger could use it to harm your site (up to and including 51.1.49)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.49
- Fixed in
- 51.1.51
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.51 or newer.
- Official ID
- CVE-2025-13997
- Report title
- King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 51.1.53) (2)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.53
- Fixed in
- 51.1.54
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.54 or newer.
- Official ID
- CVE-2025-7960
- Report title
- King Addons for Elementor <= 51.1.53 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- First reported
- Sources
- Wordfence, seen
A stranger could take over your site as an admin (from 24.12.92 up to and including 51.1.14)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- From 24.12.92 up to and including 51.1.14
- Fixed in
- 51.1.35
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.35 or newer.
- Official ID
- CVE-2025-8489
- Report title
- King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation
- First reported
- Sources
- Wordfence, seen
A stranger could run their own code on your site and take it over
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.36
- Fixed in
- 51.1.37
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.37 or newer.
- Official ID
- CVE-2025-6327
- Report title
- King Addons for Elementor <= 51.1.36 - Unauthenticated Arbitrary File Upload
- First reported
- Sources
- Wordfence, seen
A stranger could take over your site as an admin (up to and including 51.1.36)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.36
- Fixed in
- 51.1.37
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.37 or newer.
- Official ID
- CVE-2025-6325
- Report title
- King Addons for Elementor <= 51.1.36 - Unauthenticated Privilege Escalation
- First reported
- Sources
- Wordfence, seen
Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 51.1.62)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.62
- Fixed in
- 51.1.63
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.63 or newer.
- Official ID
- CVE-2025-62887
- Report title
- King Addons for Elementor <= 51.1.62 - Authenticated (Contributor+) Stored Cross-Site Scripting
- First reported
- Sources
- Wordfence, seen
Someone could do things on your site they should not be allowed to (up to and including 51.1.62)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 51.1.62
- Fixed in
- 51.1.63
- What to do
- If your site has an affected version, update King Addons for Elementor to version 51.1.63 or newer.
- Official ID
- CVE-2025-62889
- Report title
- King Addons for Elementor <= 51.1.62 - Missing Authorization
- First reported
- Sources
- Wordfence, seen
Someone could do things on your site they should not be allowed to (up to and including 24.12.58)
A trusted security source confirmed it. If your site has an affected version, fix it this week.
- Affected versions
- Up to and including 24.12.58
- Fixed in
- 24.12.59
- What to do
- If your site has an affected version, update King Addons for Elementor to version 24.12.59 or newer.
- Official ID
- CVE-2025-30926
- Report title
- King Addons for Elementor <= 24.12.58 - Missing Authorization
- First reported
- Sources
- Wordfence, seen
Where this comes from
We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.
Get an email when your site is affected.
Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.
Install Watchfox AI (free)