The vulnerability is a stored cross‑site scripting flaw in the LeapWorx Premium Addons for Elementor plugin. An attacker who can insert malicious scripts into the plugin’s data or settings can have those scripts executed later in the browsers of any site visitor, potentially leading to session hijacking, cookie theft, defacement, or the execution of arbitrary client‑side attacks. The weakness is a classic input‑validation flaw that fails to neutralize user‑supplied data before it is incorporated into a web page.

Any WordPress site that has the LeapWorx Premium Addons for Elementor plugin installed at a version equal to or earlier than 4.11.110 is affected. The vulnerability applies to all releases from the plugin’s inception through 4.11.110.

The CVSS score of 6.5 indicates a medium impact; the EPSS score is not available, and the vulnerability is not cataloged in CISA KEV. Attackers can exploit the flaw via stored input, typically through an administrative or content entry interface, and the payload is executed automatically when victims load the affected pages. Because the injection is stored, any user who views those pages is vulnerable, making the risk broad within an audience. The lack of EPSS data means the current probability of exploitation is unclear, but the medium CVSS suggests that mitigation is prudent.