The vulnerability in King Addons for Elementor allows a WordPress user with subscriber-level or higher privileges to submit malicious JavaScript in the form_page_id parameter. Because the plugin applies sanitize_text_field()—which retains quotation marks—before storing the value and later concatenates that stored value into an admin_url() call without escaping it, the script is persisted in the database and rendered unchanged when any visitor views the affected form page. This results in a stored cross‑site scripting flaw (CWE‑79) that can be used to inject arbitrary client‑side code into browsers that load the compromised page.

WordPress sites that have installed King Addons for Elementor version 51.1.62 or earlier, which provides an extensive set of Elementor widgets and templates, WooCommerce integration, Mega Menu, and Popup Builder. The CVE does not indicate that later releases, such as 51.1.63, address the vulnerability, so those newer versions remain unverified as secure.

The CVSS score of 6.4 marks this issue as a moderate severity vulnerability. Exploitation requires an authenticated account with subscriber or higher permissions, and the malicious payload is stored and later executed whenever a user opens the affected form page. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Therefore, the primary threat vector is the WordPress administration interface where form submissions are processed, enabling attackers to inject persistent scripts that will run in the browsers of anyone who views the compromised page.