Stored cross‑site scripting has been discovered in the Spider Elements add‑ons for Elementor plugin. The plugin does not properly neutralize user input that is stored for later rendering, allowing an attacker to embed malicious scripts that are then executed in the browsers of any visitor who loads the affected content.

WordPress sites running Spider Themes:Spider Elements Spider Elements plugin in any release up to and including version 1.6.5 are vulnerable. The flaw can affect any site that uses the plugin on an Elementor‑based WordPress installation.

The CVSS score of 6.5 classifies the issue as moderate severity. The EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is via a stored XSS attack where an attacker submits malicious content through the plugin’s content entry interface, resulting in injected scripts that run in browsers whenever visitors view the compromised content.