The vulnerability is an Improper Neutralization of Input During Web Page Generation that permits stored cross‑site scripting in the Elementor Element Condition plug‑in. An attacker who can inject a value into a condition field can have that code executed in the browsers of any user who views the affected page. This leads to client‑side attacks such as cookie theft, session hijacking, or defacement. The weakness is classified as CWE‑79.

The issue affects the WordPress Elementor Element Condition plug‑in (ele‑conditions) supplied by dudaster. All releases from the earliest available version up to and including 1.0.5 are vulnerable. Any WordPress site that has this plug‑in installed and uses the conditions feature is at risk.

The CVSS base score of 6.5 indicates a moderate severity. The EPSS score is below 1%, implying that few automated exploits are seeing the vulnerability, and it is not listed in the CISA KEV catalog. Nonetheless, when an attacker can write a condition value, the stored XSS can be triggered by any visitor to the affected page. The attack vector is via normal web input through the plug‑in’s condition interface; no special privileges or remote code execution on the server side are required.