A vulnerability exists in King Addons for Elementor versions up to 51.1.62 that permits the injection of arbitrary JavaScript into subscriber‑provided fields. The flaw allows an attacker to embed malicious code that will execute in the browser of any user who views the affected content, potentially compromising user accounts, stealing credentials, or spreading malware. This weakness aligns with CWE‑79 and represents a classic stored XSS scenario.

The affected product is the King Addons for Elementor plugin for WordPress. Versions 51.1.62 and earlier are vulnerable; any WordPress site using these releases is at risk. The plugin is distributed under the vendor name King Addons.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is less than 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, so there is no evidence of active exploitation campaigns utilizing this flaw. The attack vector is likely through the subscriber interface, where user‑supplied data is inserted into the database without proper encoding. An attacker with access to that interface can inject malicious scripts that will persist until the data is removed or the plugin is updated. The risk is therefore limited to sites that allow unauthenticated users to post content or to administrators who fail to disable the vulnerable fields or update the plugin.