Improper neutralization of input during web page generation causes a stored cross‑site scripting flaw. An attacker can inject malicious script into the Essential Addons for Elementor Lite plugin and have that code executed in the browsers of any user who views the affected content. The injected script could steal session cookies, deface the site, or conduct phishing attacks against site visitors. The impact is loss of confidentiality and integrity for user data, and it can lead to abuse of site functionality.

The vulnerability exists in WordPress sites that have the WPDeveloper Essential Addons for Elementor Lite plugin installed. All plugin releases from the earliest available version through version 6.1.9 are affected. The plugin is distributed for the WordPress CMS and is identified by the vendor WPDeveloper.

The CVSS score of 6.5 places the flaw in the medium severity range. The EPSS score of less than 1% indicates a very low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector requires an attacker already having the ability to submit data through the plugin’s interface— for example via a comment, testimonial, or custom field. Once a script is stored, it will be delivered to anyone who views the affected content.