This vulnerability is an improper neutralization of input during web page generation that allows attackers to inject malicious scripts which are stored and later rendered in other users’ browsers. In the context of The Pack Elementor addons, a compromised WordPress site could experience defacement, unauthorized data exfiltration, or session hijacking. The flaw arises from a classic input validation weakness, identified as CWE‑79.

Affected systems are WordPress installations running the webangon The Pack Elementor addons plugin. The defect is present in all releases from the initial launch up through version 2.1.6, so any site with the plugin installed in those versions is potentially vulnerable.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely exploit the flaw by inserting malicious code into content fields via the WordPress admin interface; the script is then stored and delivered to other users during page rendering, making this a stored XSS vector that can be triggered remotely through the web application.