The Extension for Elementor plugin fails to neutralize user supplied input before rendering it, allowing injected script to execute in the browsers of anyone who views the affected content. This cross‑site scripting flaw can lead to defacement, theft of session data, or malicious script delivery. The weakness is a classic input validation flaw classified as CWE‑79.

Infected installations run the petesheppard84 Extension for Elementor plugin, versions up to and including 2.0.40. Every release from the start of the plugin’s history through 2.0.40 is impacted; the precise lower bound is not specified in the advisory.

The CVSS score of 6.5 places the vulnerability in the medium severity range, while an EPSS score of less than 1% indicates a very low probability of active exploitation today. The flaw is not listed in the CISA KEV catalogue. The attack likely requires an attacker to place malicious code into a user‑controllable field of the plugin—such as a widget, form, or custom content block—and rely on arbitrary visitors to that page to trigger the script when they view the content. No advanced prerequisites are required beyond the presence of the vulnerable plugin version.