The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting. A malicious user could embed malicious scripts that are served to other visitors, potentially hijacking sessions or stealing credentials, without gaining code execution outside the browser. The weak point is the lack of input sanitization in the plugin’s stored content handling.

The issue affects the IdeaBox Creations PowerPack Addons for Elementor WordPress plugin, versions up to and including 3.1.0; any copy of the plugin before the 3.1.1 release is vulnerable.

With a CVSS score of 6.5 the vulnerability is considered moderate. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through the editable content features of the plugin; an attacker with permission to create or edit content can inject a payload that will be rendered in other users’ browsers. Successful exploitation would enable the actor to steal session cookies or inject further malicious content.