The vulnerability is a stored cross‑site scripting issue that occurs when the CWD Web Designer Easy Elements Hider plugin does not properly neutralize user input during page generation. An attacker can inject malicious scripts into content that is later rendered for other site visitors, enabling session hijacking, defacement, or phishing. The flaw is categorized as CWE‑79 and represents a medium‑severity flaw, with a CVSS score of 5.9.

The affected product is the WordPress Easy Elements Hider plugin from CWD Web Designer. All releases from the initial version through 2.0 are vulnerable. An up‑to‑date installation of WordPress that includes Easy Elements Hider versions 2.0 or earlier will be impacted.

The CVSS score indicates a medium risk, while an EPSS score of less than 1% suggests that the probability of exploitation is currently low. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves submitting malicious input through the plugin’s configuration or content entry interfaces—usually requiring administrative access to edit plugin settings. Successful exploitation could compromise the confidentiality, integrity, or availability of the affected WordPress site by delivering arbitrary client‑side code to users.