The vulnerability is a stored cross‑site scripting flaw in the Royal Elementor Addons plugin, where the '_elementor_data' field accepts unsanitized input. Authenticated users with Contributor-level access or higher can inject JavaScript that is saved and executed whenever any site visitor loads a page containing the injected content. This can lead to defacement, cookie theft, or malicious code execution in a victim’s browser, as described by CWE‑79.

The flaw affects the WordPress plugin Royal Elementor Addons and Templates Kit for Elementor, any WordPress installation running version 1.7.1020 or earlier. The plugin is identified in the CPE as royal-elementor-addons:royal_elementor_addons. Administrators should verify whether their site uses these affected versions.

The CVSS score of 6.4 indicates a medium severity, and the EPSS score below 1% shows an extremely low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need authenticated Contributor credentials to inject malicious code, making the risk contingent on the availability of such accounts. Prompt remediation is advised to avoid potential XSS attacks.