The Plus Addons for Elementor plugin is vulnerable to stored cross‑site scripting because the Countdown, Syntax Highlighter, and Page Scroll widgets do not properly sanitize or escape user input. This flaw, classified as CWE‑79, permits an attacker with Contributor or higher level WordPress access to embed malicious scripts that are persisted in the database and executed whenever the affected page is viewed. The consequence is arbitrary code execution in the browsers of legitimate visitors, which can lead to session hijacking, credential theft, website defacement, or the further spread of malware.

The vulnerability affects all installations of posimyththemes’ The Plus Addons for Elementor plugin, versions up to and including 6.2.2. The plugin is available for free on WordPress and is used for adding Elementor‑based addons, page templates, widgets, mega menus, and WooCommerce elements.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability requires the attacker to be authenticated with at least Contributor privileges to add or edit widget content, and the malicious payload is stored and rendered with each page load. Because it is not listed in CISA’s KEV catalog, there are no known widespread attacks at present, but the potential impact remains significant due to the script execution on every visitor’s browser.