Improper neutralization of user input during web page generation in the WordPress plugin ElementsKit Elementor addons Lite leads to stored cross‑site scripting. The flaw allows an attacker to embed malicious JavaScript that will execute in the browser of any visitor who loads a page where the plugin renders affected content. This capability can result in cookie theft, session hijacking, site defacement, or delivery of additional malware, thereby compromising the confidentiality, integrity, and availability of the WordPress installation. Based on the description, it is inferred that the vulnerability is triggered by any input that the plugin accepts for rendering, such as post titles, widget content, or other editable fields provided by the add‑ons Lite package.

The affected product is the ElementsKit Elementor addons Lite plugin for WordPress, supplied by Wpmet. Versions up to and including 4.0.6 are impacted; earlier releases are not specifically mentioned, so the assumption is that the vulnerability exists from the first released version through 4.0.6. Any WordPress site that installs any of these versions is vulnerable. The vulnerability is independent of site configuration, as the flaw resides in a core component of the add‑ons Lite package.

The CVSS score of 6.5 classifies the vulnerability as moderate severity. The EPSS score is not available, so the exact exploitation likelihood remains undefined. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation at this time. Nevertheless, stored XSS can be triggered by ordinary site users who create or edit content through the plugin’s interfaces, suggesting that the required attack conditions are readily available to anyone with editor or administrator privileges. Therefore, the risk remains significant until the vendor’s patch is applied.