Improper neutralization of input during page generation allows a stored cross‑site scripting vulnerability in the BdThemes Element Pack Elementor Addons plugin. Attackers can embed malicious JavaScript that executes when any user views a page containing the compromised content, potentially leaking session cookies, defacing content, or performing actions on behalf of the user. This weakness is a classic stored XSS flaw (CWE‑79).

The vulnerability impacts the BdThemes Element Pack Elementor Addons WordPress plugin, affecting all releases from the earliest available version up through 8.8.6. Users running version 8.8.6 or older are vulnerable.

The CVSS score of 6.5 reflects moderate severity; the EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting no publicly known exploits to date. The likely attack vector involves inserting malicious data into plugin‑managed fields that are later rendered without proper encoding. Attackers would need access to a site that uses the affected plugin, and the impact would extend to all visitors who render the compromised content, potentially compromising confidentiality, integrity, and availability of user sessions.