This vulnerability is an improper neutralization of input during web page generation that permits stored cross‑site scripting in the Themesflat Addons for Elementor plugin. Because malicious scripts are persisted in the plugin’s stored content, they are executed in the browsers of any visitor who loads affected pages, potentially enabling defacement, cookie theft, session hijacking, or phishing attacks. The weakness is a classic input‑validation flaw identified as CWE‑79.

Affected systems are WordPress installations that have the Themesflat Addons for Elementor plugin of any version through 2.3.1, inclusive. The vulnerability applies to all versions released from the plugin’s inception up to and including 2.3.1.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of <1% denotes a very low probability of active exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw via user‑controlled input stored by the plugin, which is then rendered on site pages accessible to all visitors. Successful exploitation requires the plugin to be installed and active on a WordPress site.