The X Addons for Elementor plugin contains a stored cross‑site scripting flaw due to improper neutralization of user input during web page generation, as identified by CWE‑79. The flaw allows an attacker to inject malicious payloads into stored content that will execute in the browsers of any user who views the affected page. The wording in the advisory does not explicitly list the consequences, but it is inferred that such execution could lead to session hijacking, data theft, or unwanted redirects.

Affected is the X Addons for Elementor plugin for WordPress by pencilwp, versions from n/a through 1.0.16. Users running any of these releases are vulnerable.

The CVSS score of 6.5 classifies the vulnerability as moderate in severity, while the EPSS score of less than 1 % indicates a very low current exploitation probability and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the WordPress admin interface where an authenticated user can create or edit widget content that the plugin stores and renders. No advanced prerequisites are noted, but the exposed client‑side impact remains significant if an attacker succeeds.