The X Addons for Elementor plugin is vulnerable to stored cross‑site scripting because the Youtube Video ID field is not properly sanitized or escaped. This weakness allows an attacker with contributor‑level permissions to embed arbitrary JavaScript into any page that uses the widget, and the injected code executes for all users who view that page. The impact is a compromise of confidentiality, integrity, or availability of the site’s content and can also be leveraged for further attacks such as credential theft or session hijacking.

All WordPress installations that use X Addons for Elementor up to and including version 1.0.16 are affected. The vulnerability applies to the plugin vendor PencilWP and to any WordPress site that has installed the plugin and granted contributor or higher role permissions to an attacker.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of < 1% suggests the overall likelihood of exploitation is currently low, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be local or authenticated, requiring the attacker to have contributor‑level access, after which the malicious script is stored and executed globally when visitors load the affected page. Because the flaw is stored, any user who views the page is affected, making it a potentially widespread risk within the site.