The LA‑Studio Element Kit for Elementor plugin is vulnerable because it does not properly sanitize or escape user‑supplied widget attributes, resulting in a Stored Cross‑Site Scripting (CWE‑79) issue. Authenticated users with contributor‑level access or higher can inject arbitrary JavaScript into widget content. The injected script is stored in the database and then executed whenever any visitor loads a page that contains the compromised widget, providing a persistent XSS vector.

The vulnerability exists in all WordPress installations that have the LA‑Studio Element Kit for Elementor plugin by choijun in versions up to and including 1.5.5.1. Sites using this plugin with any contributor or higher permission level are at risk if the plugin is installed with those versions.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the present time. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with at least contributor privileges; the payload is persisted and later executed client‑side when a page containing the injected content is viewed. Based on the description, it is inferred that the attack vector relies on authenticated user privileges and that an attacker could inject malicious scripts by modifying widget attributes. Because the attack vector hinges on legitimate user privileges, it can be abused by a disgruntled or compromised contributor to affect all visitors to the site.