A stored cross‑site scripting flaw exists in the URL attribute of a custom widget in ElementsKit Elementor Addons and Templates. The vulnerability allows contributors and higher‑privileged users to inject arbitrary JavaScript that is persisted and executed whenever a page containing the injected widget is accessed. Because the injected code runs in the context of the site’s visitors, an attacker could steal session cookies, deface pages, or redirect users to malicious sites.

The flaw affects the ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for WordPress plugin, identified as roxnor:ElementsKit Elementor Addons. All versions up to and including 3.5.2 are vulnerable; later releases are not affected.

The CVSS score of 6.4 indicates a moderate‑to‑high impact, while the EPSS score of <1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with at least Contributor privileges to inject the malicious code, requiring them to log in to the WordPress administrative interface and edit a page or template containing the custom widget. Once injected, the vulnerability turns into a site‑wide issue, executing in every visitor’s browser.