The plugin fails to properly neutralize user-supplied input when generating web pages, allowing an attacker to inject malicious scripts that are stored in the database and executed whenever a page is viewed. This stored cross‑site scripting can lead to cookie theft, session hijacking, defacement, and other attacks that exploit the victim’s browser. The weakness corresponds to CWE‑79, a moderate severity flaw with a CVSS score of 6.5.

WordPress sites running the Piotnet Addons For Elementor plugin version 2.4.36 or earlier. The vulnerability applies to any installation where site administrators, editors or other privileged users have the ability to create or edit widget content that is rendered by the plugin.

With an EPSS score below 1 % and no listing in CISA’s KEV catalog, the likelihood of widespread exploitation is low. However, the vulnerability can be triggered when an attacker gains access to content creation privileges, or by compromising a trusted user’s account. Once an attacker injects malicious code, it is displayed to all visitors, potentially compromising their accounts and data. The CVSS severity indicates a moderate impact, and the attack vector is most likely through the administrative interface rather than through network exposure.