The King Addons for Elementor WordPress plugin suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the 'form_page_id' parameter is sanitized using sanitize_text_field(), which does not remove double-quote characters, before being stored in post meta. Later, the stored value is concatenated into an HTML href attribute in the admin interface without proper escaping (esc_url()), enabling injection of arbitrary scripts. This vulnerability can be exploited by authenticated users with subscriber-level privileges or higher to inject persistent malicious scripts that execute in the context of users viewing the injected pages.

An attacker with subscriber-level access or above can inject arbitrary web scripts that execute in the context of other users accessing the injected pages. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not affect availability and requires authentication, but it impacts confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions carefully and monitor for suspicious activity. Avoid granting unnecessary access to untrusted users. Follow vendor updates for a security patch addressing this issue.