The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting in the WordPress plugin PDF for Elementor Forms + Drag And Drop Template Builder. Stored XSS can let an attacker inject malicious scripts into pages viewed by other site users, enabling session hijacking, defacement, or phishing. The weakness is identified as CWE‑79, a classic input validation flaw.

The affected product is add‑ons.org PDF for Elementor Forms + Drag And Drop Template Builder. Versions from the initial release through 6.2.0 are vulnerable. No other versions are listed as affected.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% signals a very low probability that exploitation is currently occurring, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through stored user‑supplied data such as form responses or template fields; an attacker can submit malicious script via the plugin’s input fields, which is then rendered unescaped in page output for subsequent visitors. While this flaw does not allow remote code execution or privilege escalation, it can compromise confidentiality, integrity, and availability of user interactions on the site.