The custom_date_key post-meta value (populated from a form’s custom-date field submission) was echoed directly into the admin submissions list column without escaping, so a script payload submitted through that field would execute in an administrator’s browser when viewing the submissions list. Fixed by wrapping the output in esc_html().
This vulnerability affects the following application versions:
- King Addons for Elementor 24.12.83
- King Addons for Elementor 24.12.84
- King Addons for Elementor 24.12.85
- King Addons for Elementor 24.12.86
- King Addons for Elementor 24.12.87
- King Addons for Elementor 24.12.88
- King Addons for Elementor 24.12.89
- King Addons for Elementor 24.12.90
- King Addons for Elementor 24.12.91
- King Addons for Elementor 24.12.92
- King Addons for Elementor 24.12.93
- King Addons for Elementor 51.1.2
- King Addons for Elementor 51.1.14
- King Addons for Elementor 51.1.35
- King Addons for Elementor 51.1.36
- King Addons for Elementor 51.1.37
- King Addons for Elementor 51.1.38
- King Addons for Elementor 51.1.39
- King Addons for Elementor 51.1.44
- King Addons for Elementor 51.1.45
- King Addons for Elementor 51.1.46
- King Addons for Elementor 51.1.47
- King Addons for Elementor 51.1.49
- King Addons for Elementor 51.1.51
- King Addons for Elementor 51.1.52
- King Addons for Elementor 51.1.53
- King Addons for Elementor 51.1.54
- King Addons for Elementor 51.1.55
- King Addons for Elementor 51.1.56
- King Addons for Elementor 51.1.57
- King Addons for Elementor 51.1.58
- King Addons for Elementor 51.1.59
- King Addons for Elementor 51.1.60
- King Addons for Elementor 51.1.61
- King Addons for Elementor 51.1.62
- King Addons for Elementor 51.1.63
- King Addons for Elementor 51.1.64
- King Addons for Elementor 51.1.65
- King Addons for Elementor 51.1.74
- King Addons for Elementor 51.1.75