An aberrant input handling flaw in the Anant Addons for Elementor plugin allows stored cross‑site scripting. The plugin fails to neutralize malicious scripts that are accepted during content creation, which are later rendered to any visitor of the site. Attackers can inject arbitrary JavaScript that executes in the browsers of all users who view affected content, enabling theft of credentials, session hijacking, defacement, or distribution of malware.

WordPress sites that run the Anant Addons for Elementor plugin with a version equal to or older than 1.2.8 are impacted. Site administrators should verify the installed plugin version and upgrade if necessary. The vulnerability applies to all installations where the plugin is active and allows user submissions or content editing without proper sanitization.

The CVSS base score of 6.5 classifies this as a medium severity vulnerability. The EPSS score of less than 1% indicates a very low probability that an exploit is actively used in the wild at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to craft a payload that the plugin will store, and then convince a user to view that content. Because the script runs in the context of the site, an attacker with any user role that can add or edit content could test the payload before it affects the wider audience.