The UiChemy plugin for WordPress contains a stored cross‑site scripting vulnerability that allows authenticated users with contributor permissions or higher to inject malicious JavaScript into the Slot Link URL field of created elements. The plugin fails to properly sanitize or escape input, so the payload is persisted to the database and rendered unescaped when a privileged user such as an editor or administrator clicks the injected link while reviewing or previewing the content, thereby providing the attacker with the ability to steal session cookies, deface the site, or perform other client‑side attacks.

This flaw affects all installations of UiChemy up to and including version 5.3.0. The plugin is used on WordPress sites that convert Figma, Prompt, and AI builds into Elementor, Gutenberg, and Bricks, and any site running a vulnerable version with contributors or higher roles is at risk.

The vulnerability receives a CVSS score of 6.4, indicating moderate severity. No EPSS score is available, but the lack of public exploitation reports and the requirement for authenticated access suggest the attack surface is limited to sites with exposed contributor accounts. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been documented. The attack vector is inferred to be an authenticated contributor or higher user who submits a crafted Slot Link URL within the plugin’s builder, and a privileged editor or administrator who subsequently clicks the injected link during post review or preview.