Improper neutralization of input during web page generation in the WPBean WPB Elementor Addons plugin creates a stored XSS flaw that allows attackers to persist malicious scripts. An attacker who succeeds in injecting a payload can cause arbitrary JavaScript to run in the browsers of any visitor who loads the affected content, which could compromise the confidentiality or integrity of user interactions. Based on the vulnerability type, this may lead to client‑side compromise such as defacement or session hijacking, though the CVE does not explicitly state these outcomes.

WPBean’s WPB Elementor Addons plugin is affected for all releases from an unspecified starting point through version 1.7. Users running any version up to and including 1.7 should verify the plugin version and assume the flaw is present.

The CVSS score of 6.5 indicates a medium severity. The EPSS score of less than 1 % suggests a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely need to submit data through the plugin’s content entry mechanisms; the CVE does not specify the exact exploitation path, so this is inferred from the nature of stored XSS flaws.