The Themesflat Addons For Elementor plugin contains a stored XSS flaw in the TF E Slider widget. Insufficient sanitization and escaping allow an attacker with Contributor or higher access to embed JavaScript that will execute in the browser context of any visitor who loads the page that contains the widget.

WordPress sites running Themesflat Addons For Elementor version 2.2.5 or earlier are affected. The vulnerability exists in all releases up to and including 2.2.5. Sites that use the plugin’s slider widget set are at risk.

The CVSS score of 6.4 indicates medium‑to‑high severity. The EPSS score of <1% suggests the probability of exploitation is low but not negligible. The flaw is not listed in the CISA KEV catalog; however, because it requires a Contributor or higher authenticated role, the threat is primarily to site administrators or content authors. Once injected, the malicious script automatically runs for every site visitor, potentially exposing session data or enabling further attacks.