The vulnerability allows authenticated users with Contributor level or higher to insert arbitrary JavaScript into widget or feature settings by exploiting inadequate input sanitization and improper output escaping. The script is stored and later executed when a visitor loads the page or an administrator previews the page in Elementor. This leads to script execution in the victim’s browser context, permitting cookie theft, session hijacking, data exfiltration, or defacement. The weakness is a DOM‑based stored XSS.

All releases of the King Addons for Elementor plugin up to and including version 51.1.38, which powers more than 80 Elementor widgets, 4,000+ Elementor templates, WooCommerce integrations, Mega Menu, and Popup Builder. The problem arises in the plugin’s JavaScript files and widget settings.

With a CVSS score of 6.4 the severity is moderate, and the vulnerability is not listed in the CISA KEV catalog. The description indicates that exploitation requires an authenticated Contributor or higher. An attacker creates or modifies a widget’s settings with malicious content, saving it so that the script is rendered in the page source. When a user loads that page, or an admin previews it, the script executes in the user’s browser, producing a typical XSS exploitation scenario. No EPSS data is available, but the requirement for authenticated access reduces the likelihood of widespread exploitation.