The King Addons for Elementor WordPress plugin before version 51.1.76 fails to escape a user-supplied grid setting before reflecting it into an HTML attribute of an unauthenticated AJAX response. This flaw permits an attacker to embed malicious JavaScript that will run in the browser of any visitor who is tricked into loading a crafted page containing the vulnerable request.

Any WordPress site that has the King Addons for Elementor plugin installed with a version older than 51.1.76. The vulnerability is specific to the Posts Grid Widget component of the plugin.

The EPSS score is listed as less than 1 %, indicating a low probability of exploitation in the wild, and the vulnerability is not catalogued in CISA’s KEV. The CVSS score of 6.1 signifies moderate severity. However, the flaw is exploitable by any unauthenticated attacker who can lure a target user to a specially crafted URL; the attacker does not need privileged access to the site and can achieve arbitrary script execution on the victim’s browser, potentially leading to data theft, credential compromise, or defacement.