This vulnerability is an improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that are stored within the UltraAddons Elementor Lite plugin. By exploiting this stored XSS flaw, an attacker can execute arbitrary client‑side code in the context of the victim’s browser, potentially leading to defacement, phishing payload delivery, or credential theft. The weakness is a classic input validation flaw identified as CWE‑79.

The issue affects the WordPress UltraAddons Elementor Lite plugin from its earliest version up to and including 2.0.2, developed by Saiful Islam. Any WordPress site that has installed this plugin with a version 2.0.2 or older is vulnerable; newer releases are not affected.

The CVSS base score is 6.5, indicating a medium severity vulnerability. The EPSS score is less than 1%, suggesting a low likelihood of exploitation at this time and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would likely occur through an attacker creating or editing content within the plugin’s interface, embedding a malicious script that is later served to site visitors. The attack vector is local to the site admin interface and requires the victim to view a page containing the stored payload.