The plugin stores user‑controlled data that is later displayed without proper output encoding, allowing an attacker to inject malicious JavaScript that executes in the browser of any user who views the affected content. This can lead to session hijacking, credential theft, or site defacement. The weakness corresponds to CWE‑79.

The WordPress plugin Piotnet Addons For Elementor, version 2.4.31 and earlier, is affected. Any site that has installed this plugin and has written content using the plugin’s modules is potentially vulnerable.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% implies a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires the attacker to have the ability to add or edit content via the plugin’s interface, which may be achievable through an authenticated session. Once the stored payload is rendered, the injected script runs with the privileges of the end‑user, providing complete client‑side compromise.