The Magic Buttons for Elementor plugin is vulnerable to stored XSS via its magic‑button shortcode. The ‘text’ attribute supplied by users is not properly sanitized or escaped, allowing injected script to persist in page content. An attacker who is authenticated with contributor or higher permissions can place arbitrary JavaScript in the shortcode, which will run in the browsers of every user who accesses that page. This flaw can be exploited for cookie theft, session hijacking, defacement, or the execution of additional malicious payloads.

All installations of the Magic Buttons for Elementor plugin on WordPress, specifically versions up to and including 1.0. The vulnerability affects any site that uses the magic‑button shortcode in its content.

The CVSS score of 6.4 classifies the issue as moderate severity, and the EPSS score of less than 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because it requires authenticated contributor‑level access, the attacker must already have the ability to edit or create content. Once that privilege is obtained, inserting a malicious shortcode is straightforward and the payload will execute in the context of any visitor to the page.