Improper neutralization of user input in the WPelite HMH Footer Builder For Elementor plugin allows attackers to embed malicious scripts that are stored and executed during page rendering. A successful exploitation can lead to session hijacking, cookie theft, defacement, or other client‑side attacks, as the weakness is a classic case of CWE‑79.

Any WordPress installation that includes the HMH Footer Builder For Elementor plugin of version 1.0 or older is affected. No specific WordPress core version is mentioned, so the entire set of sites using that plugin fall under risk.

With a CVSS score of 6.5 the vulnerability is moderate in severity. The EPSS score of less than 1% suggests a low likelihood of exploitation, and it is not listed in the CISA KEV catalogue. The attack likely requires an authenticated user with editor access to inject the malicious code, which then persists and runs for all site visitors.