WordPress plugin
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High0
- Medium17
- Low0
All King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Missing Authorization ≤51.1.87Update to 51.1.90 | CVE-2026-125444 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤51.1.86Update to 51.1.87 | CVE-2026-97298 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤51.1.85Update to 51.1.86 | CVE-2026-96835 | |
| Medium5.3 | Unauthenticated Insecure Direct Object Reference ≤51.1.81Update to 51.1.82 | CVE-2026-66575 | |
| Medium4.3 | Authenticated (Contributor+) Information Exposure ≤51.1.80Update to 51.1.81 | CVE-2026-84903 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤51.1.80Update to 51.1.81 | CVE-2026-84902 | |
| Medium4.3 | 51.1.80 - Missing Authorization ≤51.1.80Update to 51.1.81 | CVE-2026-84904 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting <51.1.77Update to 51.1.77 | CVE-2026-84896 | |
| Medium6.1 | Reflected XSS via Posts Grid Widget ≤51.1.75Update to 51.1.76 | CVE-2026-14841 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter ≤51.1.62Update to 51.1.63 | CVE-2026-15284 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting ≤51.1.62Update to 51.1.63 | CVE-2026-48870 | |
| Medium6.4 | Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets ≤51.1.53Update to 51.1.54 | CVE-2025-13535 | |
| Medium5.3 | Unauthenticated API Keys Disclosure ≤51.1.49Update to 51.1.51 | CVE-2025-13997 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤51.1.53Update to 51.1.54 | CVE-2025-7960 | |
| Critical9.8 | 51.1.14 - Unauthenticated Privilege Escalation 24.12.92 – 51.1.14Update to 51.1.35 | CVE-2025-8489 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤51.1.36Update to 51.1.37 | CVE-2025-6327 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤51.1.36Update to 51.1.37 | CVE-2025-6325 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤51.1.62Update to 51.1.63 | CVE-2025-62887 | |
| Medium4.3 | Missing Authorization ≤51.1.62Update to 51.1.63 | CVE-2025-62889 | |
| Medium4.3 | Missing Authorization ≤24.12.58Update to 24.12.59 | CVE-2025-30926 |
- Medium5.3Missing Authorization
≤51.1.87Update to 51.1.90
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤51.1.86Update to 51.1.87
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤51.1.85Update to 51.1.86
- Medium5.3Unauthenticated Insecure Direct Object Reference
≤51.1.81Update to 51.1.82
- Medium4.3Authenticated (Contributor+) Information Exposure
≤51.1.80Update to 51.1.81
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤51.1.80Update to 51.1.81
- Medium4.351.1.80 - Missing Authorization
≤51.1.80Update to 51.1.81
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<51.1.77Update to 51.1.77
- Medium6.1Reflected XSS via Posts Grid Widget
≤51.1.75Update to 51.1.76
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter
≤51.1.62Update to 51.1.63
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤51.1.62Update to 51.1.63
- Medium6.4Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets
≤51.1.53Update to 51.1.54
- Medium5.3Unauthenticated API Keys Disclosure
≤51.1.49Update to 51.1.51
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
≤51.1.53Update to 51.1.54
- Critical9.851.1.14 - Unauthenticated Privilege Escalation
24.12.92 – 51.1.14Update to 51.1.35
- Critical9.8Unauthenticated Arbitrary File Upload
≤51.1.36Update to 51.1.37
- Critical9.8Unauthenticated Privilege Escalation
≤51.1.36Update to 51.1.37
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤51.1.62Update to 51.1.63
- Medium4.3Missing Authorization
≤51.1.62Update to 51.1.63
- Medium4.3Missing Authorization
≤24.12.58Update to 24.12.59
King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder: common questions
Does King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 20 known vulnerabilities in King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder: 3 critical, 17 medium. None are known to affect version null.
How do I check which version of King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder vulnerability?
CVE-2026-125444, published Nov 11, 2026: King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.87 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder vulnerability listed in CISA KEV?
No. None of the known King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder vulnerabilities is currently listed in the CISA KEV catalog.