This flaw resides in the ‘slider_options’ parameter of the The Pack Elementor addon for WordPress. Insufficient sanitization and escaping permit stored XSS, enabling a logged‑in user with Contributor‑level access or higher to embed arbitrary JavaScript into page content. When any visitor opens the affected page, the script runs in their browser, potentially exposing session cookies, credential phishing, or arbitrary actions on behalf of the user.

All versions of the plugin up to and including 2.1.4 are vulnerable. The plugin is distributed by webangon as a WordPress extension that can be deployed on any WordPress site that includes it.

The CVSS score is 6.4 and the EPSS value is less than 1%, indicating a moderate severity but a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Because exploitation requires authenticated Contributor or higher access, an attacker only gains this capability if they have already compromised a WordPress role with sufficient privileges or if an attacker can elevate through other means. The likely attack vector is a legitimate contributor adding or editing widget content that includes malicious code, leading to widespread script execution for all users who view the page.