The vulnerability is an improper neutralization of input during web page generation that allows attackers to store malicious JavaScript in the website. Stored XSS can execute arbitrary scripts in the browsers of visitors or administrators, enabling actions such as data theft, cookie hijacking, defacement, or turning the site into a delivery vector for further malware. The weakness is classified as CWE‑79.

The flaw affects the WordPress plugin Liton Arefin Master Addons for Elementor, specifically all releases up to and including version 2.0.9.9.4. The plugin is used within the WordPress ecosystem to extend Elementor with additional modules.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is below 1 %, suggesting that widespread exploitation is not currently common, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin’s configuration interfaces that store user‑supplied values; any authenticated or unauthenticated user who can submit those settings can inject JavaScript that will later be rendered to visitors. Exploitation does not require specialized privileges beyond the ability to submit configuration data, and the stored payload persists until the values are updated or the plugin is removed.