The vulnerability is a stored XSS flaw in the MT Addons for Elementor plugin for WordPress. It results from improper neutralisation of user input, allowing attackers to inject arbitrary JavaScript that executes in the browsers of any visitor viewing affected content. The injected script can be used to deface the site, steal session cookies, or perform malicious actions on behalf of legitimate users. This constitutes a confidentiality and integrity threat to the site’s visitors and administrators.

Cristian Stan’s MT Addons for Elementor plugin for WordPress, versions up to and including 1.0.6 (no known lower bound).

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of <1% suggests that exploitation is currently unlikely, but the flaw is stored and can persist across sessions. The plugin’s web interface is the likely attack vector, whereby anyone able to post or edit content via MT Addons for Elementor can embed malicious payloads. The vulnerability is not listed in the CISA KEV catalogue yet.