The vulnerability allows an authenticated user with Contributor privileges or higher to inject arbitrary JavaScript code through the Custom JS extension of the Master Addons for Elementor plugin. The code is persisted and executed whenever a visitor loads a page containing the injected content. This is a classic stored XSS flaw identified as CWE‑79, where inadequate capability checks and missing input sanitization permit malicious payloads to remain in the site content.

WordPress sites running the Master Addons for Elementor plugin produced by litonice13, specifically all versions up to and including 2.0.8.2. The flaw is present in the Custom JS extension across these releases.

The CVSS score of 6.4 reflects medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog. Attackers must possess at least Contributor access. Once a script is stored, it executes in the browsers of any user who visits the affected page, potentially allowing arbitrary JavaScript to run in the context of that site.