The Elevio by Dixa Elevio plugin contains a Cross‑Site Request Forgery flaw that allows an attacker to inject and store arbitrary JavaScript code. The stored script is later executed when a user views the affected content, thereby creating a Stored XSS vulnerability. The description does not specify further capabilities such as credential theft or session hijack. The weakness is identified as CWE-352.

All WordPress installations running the Elevio plugin version 4.4.1 or earlier are affected. No additional configuration settings or versions are mentioned, so any deployment of this plugin up to the specified version is considered vulnerable.

The CVSS score of 7.1 indicates a high risk. The EPSS score of less than 1% suggests that exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to forge a request that the Elevio plugin accepts as legitimate, causing the malicious code to be stored and subsequently executed during normal page rendering. This requires that the request bypass any CSRF defenses the site may provide, which the plugin currently lacks.