The vulnerability enables an authenticated user with Contributor level or higher to embed JavaScript into the plugin’s widgets. The injected script is stored in the database and executed whenever a user views the affected page. This can potentially allow an attacker to steal credentials, deface content, or perform other malicious actions; these effects are inferred from typical XSS exploit scenarios. The flaw stems from insufficient input sanitization and output escaping when rendering the fancyBox widget, classified as CWE‑79.

WordPress sites running the Master Addons for Elementor plugin version 2.0.8.6 or earlier are affected. It is a plugin for the WordPress CMS, named Master Addons for Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits, which is maintained by the vendor litonice13.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1 % suggests a low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog, meaning no known widespread exploitation has been reported. However, because the attack requires authenticated Contributor access, sites with a broad Contributor user base are at heightened risk. Exploitation is straightforward once the role is obtained, as the injected code is executed automatically when any user accesses the page containing the widget.