Improper Neutralization of Input During Web Page Generation leads to Stored XSS in the Blog, Posts and Category Filter for Elementor plugin. An attacker who can push or modify content through the plugin’s administration interface can embed malicious JavaScript that executes when any visitor loads a page containing the stored payload. This enables theft of session cookies, defacement of site content, or redirection to attacker‑controlled sites, compromising the confidentiality and integrity of the site and its users.

All WordPress sites that have installed the Blog, Posts and Category Filter for Elementor plugin up to and including version 2.0.1 are affected. The description does not specify a minimum WordPress core version, so any installation of the plugin within this range is impacted.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% reflects a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, implying no documented large‑scale attacks yet. Because it is a stored XSS flaw, an attacker needs only the ability to create or edit content in the plugin; once the payload is stored, it will run automatically whenever a user views the affected page, making it a viable threat for attackers who can gain content management access.