The vulnerability is a stored XSS flaw caused by improper neutralization of user input during web page generation in PDF Generator Addon for Elementor Page Builder. An attacker can inject malicious script that will be executed in the browsers of any user who views the affected PDFs, leading to credential theft, defacement, or phishing attacks. This weakness aligns with CWE-79 and can compromise confidentiality and integrity for all visitors of the infected site.

The plugin is sold by RedefiningTheWeb under the name PDF Generator Addon for Elementor Page Builder. Versions from the initial release up to and including 2.1.0 are vulnerable. The affected product is a WordPress plugin that integrates with the Elementor page builder; specific installation details beyond the plugin name are not supplied.

The CVSS score of 6.5 places this in the medium severity range. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because it is a stored XSS that requires the attacker to create or modify content within the CMS, an attacker would need some level of authenticated access or client‑side interaction that stores malicious payloads. No external network exposure or privileged escalation is required, which limits the attack vector to authenticated content creation or injection.