The vulnerability arises from the Mega Elements – Addons for Elementor plugin’s Countdown Timer widget, which fails to sanitize user supplied attributes and to escape output in its stored content. This is a CWE‑79 stored cross‑site scripting flaw. Authenticated users who have contributor-level permissions can insert arbitrary JavaScript into the widget’s configuration, and the malicious payload is stored in the database. When any visitor subsequently loads a page containing the compromised widget, the injected script executes in the visitor’s browser context, potentially enabling session hijacking, defacement, or unauthorized content manipulation.

WordPress sites that have installed Mega Elements – Addons for Elementor versions 1.3.2 or older are affected. The plugin’s Countdown Timer widget must be present on at least one page or post for the stored XSS to be exploitable. Sites running newer releases (1.3.3 and above) are not vulnerable.

The CVSS score of 6.4 classifies this issue as a moderate severity flaw. The EPSS score of less than 1% indicates a very low probability of observed exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated contributor or higher; an attacker can therefore achieve the attack only after acquiring legitimate access to the administrative interface, typically through credential compromise or social engineering. Backed by the provided data, the most straightforward path for an attacker is to edit an existing Countdown Timer widget via the WordPress editor, supply a malicious script payload, and then publish the changes. Once one of the affected pages is accessed by site users, the stored payload will run, potentially spreading the impact to all visitors.