The Responsive Addons for Elementor – Free Elementor Addons plugin allows authenticated attackers with Contributor level access or higher to submit malicious JavaScript via the 'rael_title_tag' field. Because the input is not properly sanitized or escaped, the attacker’s code is stored in the database and later rendered when any user views the affected page, resulting in a stored cross‑site scripting vulnerability. Attackers can thus execute arbitrary scripts in the context of the site’s users and potentially steal credentials or deface content.

WordPress sites running the Responsive Addons for Elementor plugin version 1.6.9 or older are affected. The CVE applies to all deployments of the plugin listed under the vendor CyberChimps:Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates.

The CVSS score of 6.4 classifies the flaw as moderately severe, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Due to the authenticated nature of the exploit, the attacker must first obtain Contributor‑level access to the WordPress back‑end. Once authenticated, the attacker can inject the payload, and any user who views the affected page will have the script executed. The absence of an immediate public exploit means the risk remains moderate, but the potential damage to user trust and site integrity warrants prompt remediation.