King Addons for Elementor, a popular WordPress plugin, contains an input neutralization flaw that permits DOM‑based cross‑site scripting. The flaw allows injection of malicious scripts into the rendered page, potentially enabling attackers to steal sensitive information from users, deface content, or execute further code. The weakness is identified as CWE‑79.

The vulnerability affects the King Addons for Elementor plugin from the earliest release through version 51.1.61. It is relevant to any WordPress installation that has this plugin enabled and utilizes the affected versions.

The CVSS score of 6.5 indicates a medium severity. The EPSS score is below 1%, suggesting a low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. Nonetheless, XSS can be triggered when a user can supply content that is rendered by the plugin, so sites with wide user input exposure are at a higher risk. An attacker may inject code via form fields or content blocks that the plugin embeds directly into the page, thereby compromising all users who visit that page. The vulnerability remains exploitable until it is remediated by adding proper input sanitization or applying a patched version.