WPVibes’ Elementor Addon Elements plugin includes an input field where administrators and content authors can submit HTML content. The plugin fails to neutralize special characters, allowing an attacker to embed malicious JavaScript that is stored in the database and subsequently rendered when page visitors load the affected post or page. This stored XSS flaw is classified as CWE‑79 and can lead to defacement, session hijacking, or the injection of additional malware. The attack allows an adversary to compromise the confidentiality of session tokens, alter the integrity of displayed content, and degrade the trust users place in the site.

All WordPress installations that have the Elementor Addon Elements plugin from its initial release up through version 1.14.4 are affected. The vulnerability is present regardless of plugin configuration or other installed extensions, and any site that displays content managed by the plugin is at risk. Versions newer than 1.14.5 are not documented as vulnerable, so the risk is confined to the listed revisions.

The CVSS score of 6.5 indicates a moderate severity. No EPSS value is available, so the current exploitation probability cannot be quantified, but XSS vulnerabilities are routinely targeted by attackers. The vulnerability is not in the CISA KEV catalog. The likely attack vector involves a user with permission to add or edit Elementor elements; by submitting a crafted payload, the attacker can store the script and cause it to execute for every site visitor when the affected page is rendered.