Improper neutralization of input in the PowerPack Addons for Elementor plugin allows an attacker to store malicious script content. When the stored data is rendered to visitors, the embedded script runs in the context of the affected WordPress site, enabling actions such as cookie theft, session hijacking, or defacement. The weakness is a classic Stored Cross‑Site Scripting flaw identified as CWE‑79.

WordPress installations that have the PowerPack Addons for Elementor plugin installed and running any version from the first release up to 3.1.0, provided by IdeaBox Creations. Sites using the plugin in any role capable of creating or editing content are potentially impacted.

The advertised CVSS score of 6.5 indicates a moderate severity, while the EPSS score is currently unknown and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is submission of malicious input through the plugin’s content editor, based on the description. Attackers can exploit the flaw by submitting malicious input through the plugin’s content editor—either by exploiting an administrative account or any user role with content‑creation privileges. Once the payload is stored, every visitor who loads the affected page will execute the script, potentially exposing them to a range of downstream attacks.