The Anber Elementor Addon stores a button link URL without proper sanitization or escaping. A contributor or higher‑privilege user can embed arbitrary JavaScript in that field. When the affected page is subsequently viewed, the injected script runs in the victim’s browser, enabling client‑side attacks. The flaw is a classic input validation weakness identified by CWE‑79. No escalation to higher privileges is required; the impact is confined to the client side and occurs whenever the page is accessed.

The vulnerability affects the Anber Elementor Addon for WordPress, versions 1.0.1 and earlier. Users with Contributor or higher roles can inject malicious payloads; administrators may view compromised pages.

The CVSS score is 6.4, indicating moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated contributor‑level account and is achieved by inserting malicious content into the button link during content editing. Because the XSS is stored, it is inferred that any user who views the banner or page will see the injected script executed in the visitor’s browser, but the description does not state whether the vulnerability remains after content cleanup.