King Addons for Elementor Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the King Addons for Elementor WordPress plugin, affecting versions through 51.1.62. The issue arises from inadequate input sanitization in the 'add_to_submissions()' function, which uses 'sanitize_text_field()'—a method that retains double-quote characters—before saving the data to post meta. This flaw is compounded by a lack of proper output escaping in the 'king_addons_submissions_custom_column_content()' function, which directly adds the stored value into an HTML href attribute via 'admin_url()' without using 'esc_url()' to sanitize it. As a result, authenticated attackers with subscriber-level access or higher can inject malicious scripts into pages, where they will be executed when a user views the affected page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the page.

Reproduction

To reproduce this vulnerability, an authenticated user with subscriber-level access or higher can submit a form using the King Addons for Elementor plugin. The 'form_page_id' parameter can be manipulated to include malicious scripts. Once the form is submitted, the injected script will be executed when the submission is viewed, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to update the King Addons for Elementor plugin to version 51.1.63 or later, where this vulnerability has been patched.