The Elementor plugin includes an input handling flaw that fails to neutralize user data before injecting it into generated HTML, a classic Reflected XSS vulnerability (CWE‑79). An attacker could supply a specially crafted string that is then reflected in the page, enabling the execution of malicious JavaScript in the victim’s browser. The consequences include theft of credentials, session hijacking, defacement or delivery of additional malware, all without compromising the server itself.

Any site running Elementor Website Builder version 4.3.5 or earlier is susceptible. The vulnerability is present across all affected releases of the plugin for WordPress, regardless of other theme or plugin configurations.

The CVSS score of 7.1 classifies it as a high‑severity flaw. EPSS data is currently unavailable, and the issue has not been listed in the CISA KEV catalog, suggesting that a widespread, detected exploitation campaign is not yet reported. The likely attack vector is reflected XSS, where an adversary supplies malicious payloads via URLs, form input, or other unfiltered data paths that the plugin renders in the browser. Successful exploitation would require a victim to visit a crafted page or click a malicious link; authentication to the site is not strictly required for the attack to trigger.