CVE-2026-15284 Details

A stored cross-site scripting vulnerability has been identified in the King Addons for Elementor WordPress plugin, affecting versions through 51.1.62. The issue arises from inadequate input sanitization in the 'add_to_submissions()' function, which uses 'sanitize_text_field()'—a method that retains double-quote characters—before saving the data to post meta. This flaw is compounded by a lack of proper output escaping in the 'king_addons_submissions_custom_column_content()' function, which directly adds the stored value into an HTML href attribute via 'admin_url()' without using 'esc_url()' to sanitize it. As a result, authenticated attackers with subscriber-level access or higher can inject malicious scripts into pages, where they will be executed when a user views the affected page.

Users are advised to update the King Addons for Elementor plugin to version 51.1.63 or later, where this vulnerability has been patched.