The Magic Buttons for Elementor plugin allows an authenticated user with at least contributor access to inject arbitrary JavaScript through the "icon" attribute of its magic‑button shortcode. The plugin fails to sanitize or escape this user‑supplied value before storing it, enabling the attacker to embed malicious scripts that execute in the browsers of any user who views a page that contains the shortcode. This represents a classic stored XSS flaw, providing the attacker with potential to steal credentials, deface content, or perform other malicious client‑side actions. The weakness corresponds to CWE‑79, an input validation flaw leading to script injection.

WordPress sites that have installed Magic Buttons for Elementor version 1.0 or earlier, all authors of the rexdot:Magic Buttons for Elementor plugin. The vulnerability is present in all affected releases up until and including 1.0; later releases have addressed the input sanitization issue.

The CVSS score of 6.4 indicates a moderately high impact, but the EPSS score of less than 1% suggests a low probability of active exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further supporting the notion that widespread exploitation is unlikely. Because the flaw requires authenticated contributor+ access, an attacker must first obtain such a role or compromise a user with that privilege, after which they can inject script via the icon attribute. There are no known public exploits or workaround steps disclosed by the vendor; the primary mitigation is to upgrade to a patched version.