The vulnerability exists in the UiCore Elements plugin for WordPress, specifically in the UI Counter, UI Icon Box, and various UI Testimonial widgets up to and including version 1.0.16. The underlying issue is insufficient input sanitization and output escaping, which allows an authenticated user with Contributor or higher privileges to inject arbitrary JavaScript into the widget configuration. When an affected page is viewed, the injected script executes in the victim’s browser, enabling the attacker to steal credentials, hijack sessions, deface content, or perform further attacks against the site.

Vendors and products affected include uicore: UiCore Elements – Free widgets and templates for Elementor, a WordPress plugin distributed via the WordPress.org repository. Any WordPress installation that has the UiCore Elements plugin installed in a version 1.0.16 or earlier is vulnerable, regardless of the WordPress core version.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% signals a low probability of exploitation under normal conditions. The vulnerability is not listed in the CISA KEV catalog, suggesting no current known exploitation. The attack vector is authenticated access: a user who can add or edit widget content—typically a Contributor or higher—must first be authenticated to the WordPress admin area. Once they supply malicious widget code, every visitor to the affected page will trigger the script, giving the attacker broad reach over all site users.