The vulnerability arises from improper neutralization of user input during web page generation. It enables a DOM‑based cross‑site scripting flaw that could allow an attacker to inject and execute JavaScript code in the browsers of users who view affected content. This flaw aligns with CWE‑79 and could lead to session hijacking, data theft, defacement, or the execution of further exploits in the victim’s context.

WordPress sites that have the WPDeveloper Essential Addons for Elementor plugin installed, particularly versions 6.5.3 and earlier. The plugin is available in Lite edition for WordPress and the issue is covered by the CPE identifier cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:lite:wordpress:*:*

The CVSS score of 6.5 reflects a moderate severity with potential for high impact if exploited. The EPSS score of less than 1% indicates a currently low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, it remains a client‑side XSS risk that can be triggered through crafted URLs or user input, making it exploitable in scenarios where the plugin's output is rendered in a vulnerable context.