The Easy Elementor Addons plugin for WordPress allows stored Cross‑Site Scripting through several widget parameters when its version is 2.2.9 or earlier. The flaw is caused by insufficient input sanitization and output escaping, enabling authenticated users with contributor or higher privileges to embed arbitrary scripts into pages. Once injected, the script runs in the browsers of any user who views the affected page, potentially leading to session hijacking, credential theft, or defacement. The weakness is identified as CWE‑79.

The vulnerability is limited to the Easy Elementor Addons – Addons Pack for Elementor Page Builder developed by hashthemes. All installations running version 2.2.9 or older are affected, regardless of the WordPress core or other plugins. No other products are impacted.

With a CVSS score of 6.4 the flaw represents moderate severity, but its EPSS score is listed as less than 1%, indicating a very low likelihood of exploitation. The flaw is not included in the CISA KEV catalog. Exploitation requires an authenticated user with contributor-level or higher access, which limits the attack surface to internally privileged users. Attackers would likely target sites with loose role enforcement or insufficient review of widget content. Despite the moderate score, the low EPSS and privileged access requirement reduce the immediate threat level for most organizations.