The vulnerability allows an attacker to inject malicious script into content that is later rendered to visitors of a WordPress site. It is a stored XSS flaw originally flagged as CWE‑79, which means that any code supplied by the attacker can persist in the site’s database and run in the browsers of unaware users. An attacker could steal session cookies, deface the site, or redirect users to malicious domains, thereby compromising confidentiality, integrity or availability of the web experience.

The flaw exists in the LeapWorx Premium Addons for Elementor plugin up to and including version 4.11.110. Any WordPress installation that has this plugin installed and is running 4.11.110 or older is potentially vulnerable; older versions before 4.10 are also included as the vulnerability range is n/a through 4.11.110.

The CVSS score of 6.5 indicates a medium severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not presently exploited in the wild. Yet the stored‑XSS nature means that exploitation does not require network‑level access; any user submitting data via the vulnerable plugin can introduce the payload. The attack vector is inferred to be a web‑based input that is stored and later rendered without proper sanitization.