The vulnerability is a stored cross‑site scripting flaw in the Table of Contents widget of LA‑Studio Element Kit for Elementor plugin versions up to 1.4.9, caused by inadequate sanitization and escaping of attributes supplied by users. It allows contributors and higher‑privileged users to inject malicious JavaScript that will execute in the browsers of site visitors when the affected page is viewed. This flaw falls under CWE‑79.

The affected system is the WordPress plugin LA‑Studio Element Kit for Elementor, available for the WordPress content management system. All releases from the initial plugin version through 1.4.9 are vulnerable. Site administrators who are running these versions on their WordPress installations must be aware of the risk.

The CVSS base score of 6.4 indicates a moderate impact, and the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Attackers must possess at least contributor‑level access to inject the payload, after which unsuspecting site visitors will be exposed to client‑side script execution when they load the compromised page.