The Split Test For Elementor plugin contains an improper neutralization of input during web page generation that permits stored cross‑site scripting. Malicious script data can be persisted within the plugin’s split‑test configuration and executed whenever a user loads the affected page. This can lead to session hijacking, credential theft, or arbitrary code execution within the victim’s browser context, raising confidentiality and integrity concerns.

The vulnerability affects the Split Test For Elementor plugin from its earliest released versions up to and including 1.8.4. All installations of rocketelements’ plugin with a version number ≤ 1.8.4 are exposed; newer versions are not listed as affected.

The CVSS score of 5.9 indicates a medium severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation in the near term. The issue is not currently listed in CISA’s KEV catalog. The likely attack vector is injection via the split‑test content or settings fields, which usually requires an attacker to have the ability to create or edit a split test within the Elementor interface. Once injected, the payload is executed in the context of any visitor to the page containing the split test configuration.