The LA‑Studio Element Kit for Elementor plugin stores the value of the data‑lakit‑element‑link parameter directly in page content without proper sanitization or escaping. This shortfalls allows a contributor or higher‑privileged user to inject malicious JavaScript, which is then persisted in the database and executed whenever any user loads the affected page. The flaw is a classic input‑validation weakness identified as CWE‑79, enabling cross‑site scripting that can compromise visitors’ browsers. The immediate impact is the ability to run arbitrary scripts in the context of site users, potentially enabling session hijacking or data exfiltration.

All WordPress sites running the LA‑Studio Element Kit for Elementor plugin with a version of 1.5.2 or earlier are compromised. The vulnerability requires only that a user have Contributor level access or higher within WordPress, so any site that grants such permissions is affected. The issue resides solely in the plugin’s front‑end rendering process and has no effect beyond the affected pages.

The CVSS score of 6.4 classifies the vulnerability as moderate, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The flaw is not currently listed in the CISA KEV catalog. Exploitation requires authenticated access to the WordPress editor, after which an attacker can embed malicious code in a page. Once the code is stored, it will be delivered to all visitors of that page, potentially leading to credential theft or defacement. Given the moderate score and low EPSS, the risk is primarily limited to sites with an active contributor base and without additional defensive controls.