The vulnerability arises from improper neutralization of user input during web page generation, allowing a malicious attacker to inject arbitrary JavaScript into pages rendered by the Cost Calculator for Elementor plugin. This DOM‑based XSS can execute scripts in the context of unsuspecting visitors. While the CVE description does not state specific consequences, it is inferred that such an attack could enable session hijacking, credential theft, or defacement. With a CVSS score of 6.5 the flaw represents a moderate risk to confidentiality and integrity when exploited.

The affected product is the Cost Calculator for Elementor plugin from add‑ons.org. All releases up to and including version 1.3.3 contain the vulnerability. Users running those versions should be aware that any input fields or custom content supplied through the plugin may be abused.

The EPSS score of <1% indicates that the probability of exploitation is very low at present, and the plugin is not listed in the CISA KEV catalog. Exploitation would likely require a victim to visit a crafted URL or interact with a page rendering the injection point, making the attack vector user‑interactive. No public exploits are currently reported, so the risk profile remains moderate but should be monitored.