The vulnerability arises from improper neutralization of user-supplied input when generating web pages, leading to DOM‑based XSS in Debuggers Studio Marquee Addons for Elementor. An attacker can inject malicious script that runs within the context of the victim’s browser, potentially stealing credentials, session cookies, or defacing the site. The flaw does not provide remote code execution on the server but allows arbitrary client‑side code execution when a user visits a page that renders the plugin output.

The flaw affects Marquee Addons for Elementor for WordPress from the earliest available version up to 3.8.2. Any site running the plugin within this version range is susceptible.

The CVSS base score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation at the time of assessment. The flaw is not listed in the CISA KEV catalog, implying no known widespread exploitation. The primary attack vector is client‑side DOM manipulation, meaning that any visitor to a vulnerable page could trigger the XSS effect; therefore, the risk is tied to the site’s traffic and the visibility of the vulnerable plugin.