An attacker can inject malicious scripts into the browser context of any user who loads a page rendered by the affected WordPress plugin. The flaw occurs because the plugin fails to properly neutralize user‑controlled input when generating the page, leading to a DOM‑Based XSS vulnerability. An attacker could use this to steal session cookies, deface content, or perform malicious actions on behalf of a logged‑in user.

WordPress sites that have the ElementInvader Addons for Elementor plugin installed with a version legacy to or including 1.3.0. The plugin, developed by Element Invader, interacts with the Elementor page builder and is visible through the WordPress plugin directory.

The vulnerability scores a 6.5 on the CVSS scale and has a very low EPSS probability (< 1%), indicating few reported exploits. It is not currently listed in the CISA KEV catalog. Attackers would require the ability to inject crafted input into the plugin’s data handling, which can often be achieved through administrative interfaces or by manipulating front‑end URLs. Because it is a DOM‑Based XSS, the impact is limited to the victim’s browser session, but it remains risky for users who interact with the affected content.