The Exclusive Addons for Elementor plugin is vulnerable to a stored Cross‑Site Scripting flaw in the Countdown Widget. Inadequate sanitization and output escaping allow an authenticated user with Contributor privileges to inject malicious JavaScript that will run for all visitors who view a page containing the widget. This can lead to session hijacking, credential theft, or defacement.

WordPress sites using the Exclusive Addons for Elementor plugin, version 2.7.9.4 or earlier. The issue affects every installation where the Countdown Widget is enabled, regardless of theme or site configuration.

The CVSS score is 6.4, indicating a moderate severity. The EPSS score is less than 1%, which suggests exploitation activity has not been observed on a large scale so far, and the vulnerability is not catalogued in the CISA KEV list. Attackers must have authenticated Contributor or higher access to add or edit a widget. Once the malicious script is stored, any user who accesses the affected page will execute the payload, making the risk mainly threat to all site visitors once the flaw is exploited.