The Pack Elementor addon for WordPress contains a stored cross‑site scripting vulnerability in its Typing Letter widget. Because user supplied attributes are not sanitized or escaped, an authenticated attacker with contributor‑level access or higher can inject arbitrary JavaScript that is saved to the page and executed whenever any visitor loads that page. The injected script can steal credentials, deface content, or perform other malicious actions for all users who view the affected page. This is a CWE‑79 (Cross‑Site Scripting) vulnerability.

The vulnerability affects the Pack Elementor addon by WebAngon. All releases up to and including version 2.1.5 are impacted.

The CVSS base score is 6.4, indicating a moderate severity. The EPSS score is below 1 %, implying a low probability that the flaw is being actively exploited in the wild, and it is not listed by CISA in the KEV catalog. Exploitation requires a user role of contributor or higher and insertion of malicious code through the widget interface. Once the code is stored, it is executed for every user who accesses the page, potentially leading to credential theft or defacement.