The Better Elementor Addons plugin contains a stored XSS vulnerability in its Slider widget caused by inadequate input sanitization and output escaping. Attackers with authenticated contributor or higher access can inject arbitrary JavaScript into plugin configuration that will run on any visit to the affected page, potentially defacing content or hijacking user sessions.

WordPress sites running the wpdive:Better Addons for Elementor plugin, versions 1.5.5 and earlier, including 1.5.5. The flaw is present in all releases up to and including this version.

The CVSS score of 6.4 reflects medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. Attack requires an authenticated user with contributor‑level or higher privileges; the attacker needs to edit the Slider widget to embed malicious code, which will then execute when any user loads the page containing the injected widget.