The vulnerability is a stored cross-site scripting flaw that allows an attacker to inject and persist arbitrary JavaScript into the plugin’s output. The stored payload is not properly neutralized during page rendering, enabling an attacker to execute malicious code in the browser context of any user who views the compromised content.

The flaw affects the Make Section & Column Clickable For Elementor plugin by Riyadh Ahmed, all releases up to and including version 2.4. Any WordPress site that has installed this plugin before version 2.4 is exposed.

The severity is graded as medium with a CVSS score of 5.9, and the EPSS score is less than 1 %, indicating a low likelihood of exploitation observed to date. Because the plugin stores the injected data, an attacker who can create or edit Elementor sections can permanently compromise the site. The vulnerability is not listed in the CISA KEV catalog, but it should still be addressed promptly.