CVE-2026-84902

King Addons for Elementor (WordPress plugin) versions before 51.1.81 lack an object-level authorization check when importing template content into a page. Users with contributor-level access or higher can overwrite the Elementor content of arbitrary posts and pages —including those owned by admin...

CVE-2026-84902 King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...