CVE-2026-15284: King Addons for Elementor XSS Vulnerability

CVE-2026-15284 Overview

CVE-2026-15284 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the King Addons for Elementor plugin for WordPress in versions up to and including 51.1.62. The flaw resides in the form submission handling logic, where the form_page_id parameter is stored without adequate sanitization and later rendered without proper output escaping. Authenticated attackers with subscriber-level privileges or higher can inject arbitrary JavaScript that executes when an administrator or other user views the affected submissions page. The vulnerability was patched in version 51.1.63.

Critical Impact
Authenticated attackers with low-privilege subscriber accounts can inject persistent JavaScript payloads that execute in the browser context of any user viewing the WordPress submissions administration page.

Affected Products

King Addons for Elementor plugin for WordPress (versions ≤ 51.1.62)
Form Builder widget component (Create_Submission.php, View_Submissions_Pro.php)
WordPress sites with subscriber registration enabled and King Addons Form Builder deployed

Discovery Timeline

2026-07-10 - CVE-2026-15284 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15284

Vulnerability Analysis

The vulnerability stems from a two-part failure in input sanitization and output escaping within the King Addons Form Builder helpers. The add_to_submissions() function processes the form_page_id parameter using WordPress's sanitize_text_field() before storing it in post meta. This sanitizer strips control characters and tags but preserves double-quote characters, making it insufficient for values later placed inside HTML attributes.

The second half of the bug lives in king_addons_submissions_custom_column_content(). This function concatenates the stored form_page_id value into an href attribute produced by admin_url() without wrapping the final URL in esc_url() or esc_attr(). Because double quotes survive sanitization, an attacker can break out of the attribute context and inject event handlers or <script> payloads that execute when the submissions column renders.

Root Cause

The root cause is a mismatch between the chosen sanitization primitive and the eventual output context. sanitize_text_field() is designed for plain text, not HTML attributes, and the rendering path assumes trusted data by omitting esc_url(). Both Create_Submission.php (line 68) and View_Submissions_Pro.php (line 305) participate in the sink chain, as shown in the WordPress King Addons Create Submission Code and WordPress King Addons View Submissions Pro Code.

Attack Vector

An authenticated attacker with at least subscriber-level access submits a crafted form request containing a malicious form_page_id value. The payload uses double quotes and JavaScript event handlers to escape the href attribute context. When a site administrator later views the submissions listing, the injected script executes in their browser session, enabling session theft, forced administrative actions via CSRF, or persistence through additional plugin/theme modification.

The vulnerability mechanism is described in the Wordfence Vulnerability Advisory. No synthetic exploit code is provided here; refer to the upstream advisory for further technical detail.

Detection Methods for CVE-2026-15284

Indicators of Compromise

Unexpected <script> tags, on*= event handlers, or javascript: URIs stored in the king_addons_form_submissions post meta or related database rows.
New or modified WordPress administrator accounts created shortly after subscriber-level form submissions.
Outbound requests from administrator browsers to unknown domains after visiting the King Addons submissions page.
Presence of King Addons for Elementor plugin versions 51.1.62 or earlier on the WordPress installation.

Detection Strategies

Audit the WordPress wp_postmeta table for entries associated with King Addons submissions containing quote characters, angle brackets, or JavaScript keywords in the form_page_id field.
Review web server access logs for POST requests to form submission endpoints originating from low-privilege authenticated sessions.
Compare plugin file hashes against the official 51.1.63 release to identify unpatched installations.

Monitoring Recommendations

Alert on WordPress administrator session activity that immediately follows the viewing of the submissions administration page.
Monitor for creation of new administrator users, changes to wp_options, or plugin/theme edits following submissions review.
Track subscriber-level account registrations correlated with rapid form submissions on sites running King Addons.

How to Mitigate CVE-2026-15284

Immediate Actions Required

Update King Addons for Elementor to version 51.1.63 or later on all WordPress installations.
Review existing form submissions data and purge any entries containing script payloads or suspicious form_page_id values.
Audit WordPress user accounts and remove unrecognized administrator or editor accounts created since deployment of the vulnerable version.
Rotate credentials and session tokens for any administrator who accessed the King Addons submissions page while the vulnerable version was installed.

Patch Information

The vendor released a fix in King Addons for Elementor version 51.1.63. The patch adds proper output escaping to the submissions column rendering and tightens input handling for the form_page_id parameter. See the WordPress King Addons ChangeSet Overview and the ChangeSet for View Submissions Pro for the code-level changes.

Workarounds

Disable open user registration or restrict the subscriber role until the plugin is patched.
Temporarily deactivate the King Addons Form Builder widget if immediate patching is not feasible.
Deploy a Web Application Firewall (WAF) rule that blocks form submissions containing suspicious characters in the form_page_id parameter.
Restrict access to /wp-admin/ submission listing pages using IP allowlists or additional authentication layers.