DeThemeKit For Elementor allows users to store arbitrary scripts that are later rendered in the browser without proper sanitization. The Stored XSS flaw permits an attacker to inject JavaScript into the site’s page output, which can lead to cookie theft, session hijacking, defacement, or other client-side attacks. This weakness corresponds to CWE‑79: Improper Neutralization of Input.

The vulnerability exists in all releases of DeThemeKit For Elementor up to and including version 2.1.8. WordPress sites that have the plugin installed and are running any of those versions are exposed until the issue is corrected by a newer release.

The CVSS score of 6.5 indicates a moderate impact. The EPSS score of less than 1 % suggests that exploitation is unlikely but not impossible, especially for targeted attacks. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is the ability to create or edit content through the DeThemeKit plugin, which stores the malicious payload and renders it to visitors. The attacker would need a role with content authoring privileges, or, alternatively, exploit a compromised account to inject the script.