missing_capability
register_post_type('ae_element') leaves capability_type at the default 'post' (the Kadence-style ['kadence_element','kadence_elements'] pair is commented out) with map_meta_cap true, show_ui/show_in_menu/show_in_rest true. Any role with publish_posts (Author, Editor, Administrator) can therefore create a published element from wp-admin or POST /wp/v2/ae_element. Metabox::save_metabox (save_post_ae_element) then writes the attacker-chosen hook name from $_POST['_ae_element_fields_hook_custom'] after sanitize_text_field, gated only by edit_post/edit_page on that object — not manage_options or a dedicated cap — and never calls wp_verify_nonce on the ainsys_template_inner field it prints. On the front end, Controller::init_frontend_hooks (wp priority 99; the apply_filters('ae_element_display', check_element_conditionals(...)) limiter is commented out) loads every published ae_element and add_action()s the stored hook (or the 'custom' alias) to output_element, which echoes apply_filters('ae_the_content', $post->post_content) with do_blocks/do_shortcode and no wp_kses_post. Observable: an Author sets Hook Name to wp_footer or woocommerce_before_checkout_form, publishes, and kses-allowed markup (links, images, layout HTML) appears on every matching public request, including pages and checkout they cannot edit. Users without unfiltered_html cannot store <script> (core kses on save); this is site-wide content injection / defacement, not Subscriber XSS. Fix: restore a dedicated capability_type (or require edit_theme_options/manage_options), verify the metabox nonce, re-enable display conditionals, and kses output unless the author has unfiltered_html.
classes/class-cpt.php:190-217
RecommendationGive ae_element a dedicated capability_type (or cap_type page / manage_options) so Author/Contributor cannot publish site-wide injections; map those caps only onto trusted roles. In save_metabox, wp_verify_nonce('ainsys_template_inner') and keep current_user_can on the element. Restore the check_element_conditionals / ae_element_display gate before add_action. Escape or wp_kses_post frontend output unless the storing user had unfiltered_html. Allow-list hook names instead of passing the metabox string straight to add_action.