The vulnerability is a stored cross‑site scripting flaw in Elementor Web­site Builder released up to version 3.35.5. By sending specially crafted widget parameters through the REST API, an authenticated user with Contributor or higher access can embed arbitrary JavaScript that is written to the page’s content. When other visitors load the affected page, the injected script runs in their browsers, allowing the attacker to steal session cookies, deface the site, or redirect users to malicious sites.

All installations of the Elementor Web­site Builder plugin for WordPress with a version number of 3.35.5 or earlier are affected. The flaw exists in the widget parameter handling code and is present across the plugin’s API endpoints. Vendors or site owners using this plugin should verify that the version installed is 3.35.6 or later to remove the issue.

The severity rating is moderate, with a CVSS score of 6.4. Exploitation requires legitimate authentication with Contributor or higher role through the WordPress REST API; the attacker can then post malicious widget data. Since the vulnerability is not listed in CISA’s KEV catalog and no EPSS score is available, the likelihood of widespread exploitation remains uncertain, but the impact on any site that accepts contributor content is significant.