The Premium Addons for Elementor plugin for WordPress allows an attacker who can authenticate with Contributor or higher privileges to inject arbitrary JavaScript into the data‑countdown attribute of the Countdown widget. Because the attribute is not properly sanitized or escaped, the malicious script is stored in the post content and rendered into the page. When any visitor loads that page, the script executes in their browser, allowing the attacker to run code in the context of the site for all users who view the affected page.

Every instance of the Leap13 Premium Addons for Elementor plugin for WordPress with a version of 4.11.8 or earlier is affected. Updating to any later release eliminates the vulnerability.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1 %, showing that wide‑scale exploitation is unlikely. It is not listed in the CISA KEV catalog. Exploitation requires authentication as a Contributor or higher and occurs through the authoring interface where a user can edit widget attributes. Once the malicious data‑countdown value is stored, it will run for every visitor to the page.