The DethemeKit for Elementor plugin for WordPress contains a vulnerability in the De Product Display Widget countdown feature that permits an authenticated user with Contributor-level access or higher to store and inject arbitrary JavaScript into page content. Because the injected script is persisted, it will execute in the browsers of all users who view the affected page, allowing the attacker to run malicious code on the site.

WordPress sites that have installed DethemeKit for Elementor in version 2.1.9 or earlier and have at least one user with Contributor-level privileges—or any role equal to or greater than Contributor—are affected. The vulnerability exists in all builds up through 2.1.9, so any site running that exact or earlier version is at risk.

The vulnerability carries a CVSS v3.1 score of 6.4, classifying it as medium severity. The EPSS score of less than 1% indicates a low likelihood of exploitation at present. Exploitation requires authenticated access; therefore the attack vector is internal, and an adversary must first compromise a Contributor or higher account before injecting the payload. The vulnerability is not listed in the CISA KEV catalog, meaning there is currently no record of widespread exploitation.