WPBITS Addons For Elementor Page Builder contains a stored Cross‑Site Scripting vulnerability caused by improper input neutralization. The flaw allows an attacker to store malicious scripts through exposed content fields, which are rendered on the front‑end without sanitization. When another visitor loads the affected page, the script executes in their browser, enabling cookie theft, session hijacking, defacement, or execution of arbitrary JavaScript in the context of the site.

All installations of the WPBITS Addons For Elementor Page Builder plugin for WordPress with versions up through 1.5.1 are affected. The issue affects the plugin itself and any content created with it; there is no specific dependency on other plugins or themes beyond WordPress.

The vulnerability scores a CVSS base of 5.9, indicating moderate impact. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would typically exploit the flaw by inserting crafted data into content fields that are stored and later rendered to all site visitors, requiring no special privileges. Although the likelihood of exploitation is currently low, the impact of a successful XSS could be significant for users interacting with affected pages.