The King Addons for Elementor WordPress plugin is vulnerable to stored cross-site scripting (CWE-79) due to improper neutralization of input during web page generation. The vulnerability arises from the add_to_submissions() function applying sanitize_text_field(), which does not remove double-quote characters, before storing the 'form_page_id' parameter in post meta. Later, the king_addons_submissions_custom_column_content() function outputs this stored value inside an HTML href attribute without using esc_url() for escaping. This combination allows authenticated attackers with subscriber-level privileges or higher to inject arbitrary JavaScript that executes in the context of users viewing the injected page.

An attacker with subscriber-level or higher access can inject persistent malicious scripts via the 'form_page_id' parameter. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, unauthorized actions, or data theft within the WordPress admin or user interface. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity. Avoid using affected versions (<=51.1.62) in sensitive environments. Follow vendor channels for updates and apply official patches once released.