The WordPress News Kit Elementor Addons plugin suffers from an improper neutralization of input during web page generation that permits attackers to store malicious JavaScript code in the plugin’s data. This stored XSS flaw can run in the browsers of any user who views the affected content, leading to session hijacking, credential theft, and the ability to perform actions as the victim. The weakness aligns with CWE‑79, indicating a classic cross‑site scripting vulnerability.

Affected products are the News Kit Elementor Addons plugin from blazethemes, all releases up to and including version 1.4.2. No specific sub‑version ranges are listed beyond the end‑point of 1.4.2.

The CVSS score of 6.5 classifies the flaw as moderately serious, and the EPSS score of less than 1 % suggests a low current exploitation probability, though attackers still could leverage the stored payload through the plugin’s content editing interfaces. The vulnerability is not listed in CISA’s KEV catalog, reducing the likelihood of widespread active exploitation. If an attacker can inject the payload via the administrative interface, any site visitor of the affected page will execute the embedded script, potentially compromising sensitive data and enabling further attacks.