CVE-2026-15284Medium· 6.4▾ Sunlit

The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to, and including, 51.1.62 This is due to insufficient input sanitization in the add_to_submi…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score35/ 100 · Low

impact 35.2 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 10, 2026

Updated

Jul 10, 2026

CVSS

6.4

Vendor

—

Product

—

CWE

CWE-79

Depth score

35 · Low

EPSS

0.42% · p36

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 11.

0.3% → 0.4%▲ 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 45 days

Jul 10, 2026Published
Disclosed via NVD
Jul 11, 2026EPSS first tracked
0.3%
Aug 24, 2026EPSS peak
0.3% → 0.4%

CWE-79 #nvd

Full technical detail▾

Overview

The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_page_id' parameter in versions up to, and including, 51.1.62 This is due to insufficient input sanitization in the add_to_submissions() function, which applies sanitize_text_field() (which preserves double-quote characters) before storing the value in post meta, combined with missing output escaping in the king_addons_submissions_custom_column_content() function, which concatenates the stored value into an HTML href attribute via admin_url() without wrapping the result in esc_url(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd