The flaw allows an attacker with contributor‑level access in the ElementsKit Elementor Addons and Templates WordPress plugin to inject arbitrary scripts into the before/after labels of the image comparison widget. This stored cross‑site scripting can execute whenever victims view a page that contains the compromised widget, potentially allowing session hijacking, defacement, or the execution of further malicious code.

WordPress sites that have the ElementsKit Lite plugin, version 3.5.2 or earlier, installed from the roxnor:ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor package. The vulnerability is present in all releases up to and including 3.5.2, affecting all users who can add or edit content with contributor‑level permissions.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is less than 1%, suggesting the likelihood of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. However, because any contributor or higher role may inject the payload, the risk to sites with widespread or untrusted content authors remains significant. Exploitation requires authenticated access, but once the malicious script is stored it will run for all page visitors, making it a potent threat in environments where contributor privileges are widely granted.