The Lenix Elementor Leads addon for WordPress is vulnerable to stored Cross‑Site Scripting due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary JavaScript via a URL form field that is saved and rendered on pages. When users view the affected page the injected script executes in their browser, potentially allowing session hijacking, defacement, or phishing.

The affected product is the Lenix Elementor Leads addon published by yonifre under the name Lenix Leads Collector. All releases through version 1.8.2, inclusive, are vulnerable. No specific sub‑versions are listed; the issue applies to all builds up to and including 1.8.2.

The CVSS base score is 7.2, indicating moderate severity. The EPSS score is below 1 %, implying a low current threat likelihood. As the vulnerability is unauthenticated and stored, an attacker only needs to submit malicious input through the public form and persuade or force users to view the contaminated page. The vulnerability is not listed in CISA’s KEV catalog.