The Events Addon for Elementor plugin is vulnerable due to insufficient input sanitization and output escaping on user‑supplied attributes in its Typewriter and Countdown widgets. The flaw allows authenticated users with Contributor level or higher to inject arbitrary JavaScript that will execute on any page displaying the affected widget. This stored XSS vulnerability is classified as CWE‑79.

The vulnerability affects all versions of the Events Addon for Elementor by nicheaddons up to and including 2.2.9. No specific sub‑versions are listed as outside the affected range.

With a CVSS score of 6.4, the threat is moderate but real. The EPSS score of less than 1% indicates a very low probability of exploitation at present, and the flaw is not yet listed in CISA's KEV catalog. The attack vector requires authenticated access with Contributor or higher privileges, meaning that roles with that level of permission should be examined before applying a temporary defense.