This vulnerability is an improper neutralization of input during web page generation that allows a DOM‑based XSS attack by injecting arbitrary JavaScript into the rendered page. An attacker can exploit the plugin to execute code in the browsers of users who view the affected content, potentially compromising the confidentiality, integrity, or availability of information presented to those users.

The affected target is the WordPress Post in page for Elementor plugin, version 1.0.1 and earlier, deployed by Michael. Any WordPress installation that has this plugin and an affected version installed is at risk.

The CVSS score of 6.5 indicates a moderate impact due to the ability to run client‑side scripts. The EPSS score is below 1%, implying a very low probability of exploitation at the present time. The vulnerability is not listed in the CISA KEV catalog, meaning no widespread exploitation has been reported. The likely attack vector is through user‑controllable post content or URL parameters that the plugin fails to sanitize, enabling a DOM‑based XSS during page rendering.