The Elementor plugin contains an insufficient neutralization of user‑supplied input used in the Text Path widget. Injected characters are incorporated into SVG markup that is stored in the page content, causing the web browser to execute arbitrary JavaScript whenever a user loads that page. An authenticated user with contributor level or higher can perform the injection. The impact is the execution of client‑side script on any visitor to the compromised page.

WordPress sites that use the Elementor plugin, version 3.33.3 or earlier. The vulnerability is present in all releases up to and including 3.33.3, affecting the Text Path widget of the plugin.

The CVSS score of 6.4 indicates a medium severity. The EPSS score of less than 1% suggests that current exploitation likelihood is low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with contributor privileges, and the attack vector is via the plugin’s user interface that stores SVG content in the database. Once stored, the data is rendered on all page views, allowing the attacker to affect any site visitor. Overall risk is moderate due to the requirement for contributor access, but the potential for widespread client‑side compromise warrants swift action.