Improper neutralization of user input during page generation enables the BdThemes Element Pack Elementor Addons plugin to store malicious scripts. When a compromised element renders the stored content, the browser executes the injected script within the site’s context, allowing an attacker to hijack sessions, exfiltrate data, or deface the website. This flaw is a classic example of input validation failure as identified by CWE‑79.

The vulnerability affects the WordPress Element Pack Elementor Addons plugin provided by BdThemes. All releases from the earliest available version through 8.8.6 contain the flaw; upgrading to any version 8.8.7 or newer removes the risk. No specific sub‑components or configuration settings are exempt within the affected range.

The CVSS score of 6.5 indicates moderate severity. Because no EPSS value is supplied, the current exploitation probability is unknown, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through user‑supplied content that the plugin stores and then surfaces without proper escaping, meaning an attacker can inject payloads via form fields or management interfaces that persist and later execute in the browsers of site visitors.