The News, Magazine and Blog Elements plugin for WordPress contains a stored cross‑site scripting flaw caused by improper input neutralization during page rendering. When an attacker injects malicious script into plugin content or configuration, the script is later served to all visitors, potentially enabling session hijacking, credential theft, or site defacement. The weakness is classified as a CWE‑79 vulnerability arising from unsanitized user input.

WordPress sites running the aThemeArt News, Magazine and Blog Elements plugin with any version up to and including 1.3 are affected. The vulnerability applies to all installations that allow content creation or configuration through this plugin, regardless of WordPress core version.

The CVSS score of 6.5 denotes a medium‑severity issue, while an EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply or modify content via the plugin’s administration interface or another authorized channel. Once the script is stored, it is executed in the browsers of all users that view the affected content.