The vulnerability is a stored cross‑site scripting flaw that occurs in the Accordion Repeater Block of the RTMKit Addons for Elementor plugin. Insufficient sanitization of user‑supplied attributes allows contributors to inject arbitrary script code, which is persisted and executed whenever a visitor loads an affected page. The injection is performed in the context of the website, giving an attacker the ability to steal cookies, hijack sessions, deface content, or load additional malicious resources.

All WordPress sites running RTMKit Addons versions 1.6.1 or earlier are affected. The plugin is developed by roman heme and provides accordion widgets for Elementor; the flaw resides entirely in the plugin’s code, so any WordPress installation that has not upgraded beyond 1.6.1 and has this plugin installed is vulnerable regardless of the core WordPress version.

The CVSS base score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at the moment. Exploitation requires authenticated access at the contributor level or higher, limiting the attack surface to sites that grant such permissions. The flaw is not listed in CISA KEV, implying no large‑scale exploitation has been reported. Nonetheless, once an attacker can inject an accordion block, the malicious payload will run for every user who views the page, potentially leading to significant compromise.