The WP Post Modules for Elementor plugin contains an improper neutralization of user input when generating web pages, which allows reflected cross‑site scripting. This flaw can lead to arbitrary client‑side script execution, enabling a malicious actor to steal user information, deface content or hijack user sessions within the affected site.

The vulnerability is present on all WordPress sites that use the SaurabhSharma WP Post Modules for Elementor plugin with a version of 2.5.0 or earlier.

The CVSS score of 7.1 indicates a high impact risk, while the EPSS score of less than 1% suggests a low likelihood of immediate exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted URL or form that echoes unescaped user input back to the browser, which can be triggered by an unauthenticated user or anyone who can access the public‑facing pages.