An input validation flaw in the Custom iFrame for Elementor plugin allows an attacker to inject malicious scripts via DOM‑based XSS. The vulnerability enables the execution of arbitrary code in the context of a victim’s browser, potentially leading to session hijacking, data theft, and site defacement. The flaw stems from improper sanitization of user‑provided content that is rendered within an iframe on the page.

WordPress sites that have installed the Coderz Studio "Custom iFrame for Elementor" plugin version 1.0.13 or earlier are affected. Any deployment of the plugin through these versions exposes the site to the XSS risk.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, but attackers can exploit it by inserting crafted content into the plugin’s iframe fields, which may be available to authenticated administrators or, if misconfigured, to public users. The attack vector is inferred to involve unsanitized user input within the plugin’s interface, which is processed without proper escaping before rendering.