The ElementsKit Pro plugin is affected by a DOM‑Based Stored Cross‑Site Scripting flaw that originates from the unchecked ‘url’ parameter in all versions up to 3.7.8. The vulnerability follows CWE‑79, enabling an attacker who can authenticate with Contributor or higher level access to inject arbitrary web scripts. Those scripts are stored within the plugin’s pages and run automatically whenever any user visits the affected page, potentially compromising confidentiality, integrity, and availability of the site and its visitors.

WordPress sites that have the ElementsKit Pro plugin from wpmet installed, including all releases up to version 3.7.8.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The attack is limited to authenticated users with Contributor or higher privileges, but once a script is injected it is executed for any subsequent user who views the page. The vulnerability is not listed in the CISA KEV catalog, so there is no current evidence of active exploitation in the wild.