The ElementsKit Elementor addons plugin for WordPress contains an input sanitization and output escaping flaw in the Image Accordion widget that allows authenticated users with contributor-level privileges to store JavaScript payloads. When a site visitor views a page containing the injected widget, the malicious script executes in their browser, giving the attacker the ability to steal session cookies, deface content, or perform other cross‑site scripting attacks. The vulnerability is identified as a stored cross‑site scripting issue (CWE‑79).

All releases of the ElementsKit Elementor Addons plugin up to and including version 3.4.0 are affected. The plugin is distributed under the vendor roxnor and is used within WordPress installations that implement advanced Elementor widgets. The Image Accordion widget is the entry point for the injection; any deployed instance of the plugin prior to the 3.4.1 release remains vulnerable.

The recorded CVSS score is 6.4, indicating medium impact. The EPSS score is less than 1 %, implying a low frequency of exploitation observed so far, and the vulnerability is not yet listed in CISA's KEV catalog. The attack vector is web‑based; an attacker must be able to log into the WordPress admin area with contributor or higher role, create or edit an Image Accordion widget in a page, and then have a site visitor load that page for the payload to run. Because the attack relies on legitimate site access and does not require elevated privileges beyond contributor level, sites with many contributors are at higher risk.