The vulnerability is a DOM‑based XSS flaw that results from improper neutralization of input during web page generation. When an attacker supplies input that is reflected in the plugin’s output, malicious JavaScript can be executed in the victim’s browser, enabling credential theft, defacement, or other client‑side attacks. The weakness is classified as CWE‑79.

The affected product is the Happy Monster Happy Addons for Elementor WordPress plugin, versions up to and including 3.16.2. WordPress sites that employ any of those releases are potentially vulnerable.

The CVSS score of 6.5 indicates moderate impact; the EPSS score of less than 1% suggests a low probability of widespread exploitation, and it is not listed in the CISA KEV catalog. Based on the nature of DOM‑based XSS, an attacker needs to supply malicious input that the plugin reflects in the page; this is inferred from the vulnerability description and is not explicitly detailed in the CVE data. The typical attack vector is via user‑controlled or crafted URL input that triggers the JavaScript execution.