The WPBakery Visual Composer WHMCS Elements plugin contains an input handling flaw that allows stored cross‑site scripting. The vulnerability arises when user input is rendered without proper escaping during page generation. The stored script is then executed in visitors’ browsers, enabling malicious actions such as defacement or credential theft.

WordPress sites that run the voidcoders WPBakery Visual Composer WHMCS Elements plugin version 1.0.4.3 or earlier are affected. All releases from the first public one up to 1.0.4.3 contain the flaw, while later releases are presumed not to.

The CVSS score of 6.5 indicates medium severity. The EPSS score of < 1% reflects a low probability of active exploitation today, and the issue is not listed in CISA KEV. The attack surface involves the plugin’s data input interfaces; the failure to escape input allows attacker‑supplied code to be stored and executed when the plugin renders pages for all site visitors. It is not specified whether authentication is required to submit the malicious payload; the CVES description does not indicate this requirement.