The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| King Addons Plugin | — | Update king-addons plugin to version 51.1.81, or a newer patched version | Oct 30, 2026 | Sep 16, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub