The Elementor Website Builder Pro plugin for WordPress contains a stored cross-site scripting flaw caused by inadequate sanitization of the ‘button_text’ field. Authenticated users with Contributor level access or higher can inject arbitrary JavaScript that will be persisted in the database and executed whenever a site visitor loads the affected page. The flaw is limited to the execution of injected scripts within the context of the victim’s browser and does not provide attackers with direct server‑side privileges or data exposure beyond what the script can obtain client‑side.

All releases of the Elementor Website Builder Pro plugin for WordPress up to and including version 3.29.0 are affected. Users running these versions are vulnerable regardless of site configuration or additional plugins, as the flaw resides in the core handling of the button_text parameter.

The vulnerability receives a CVSS score of 6.4, indicating moderate severity. Its EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild at this time. The flaw is not catalogued in the CISA KEV list. Attackers must first authenticate with Contributor privileges or higher, then modify the button_text field to store malicious JavaScript. Once stored, the script executes for any visitor to the page, creating a risk that is limited to those who access the injected content.