The vulnerability allows an attacker to inject malicious JavaScript that is stored within content managed by the WPVibes AnyWhere Elementor plugin. When users load affected pages, the script executes in their browsers, potentially enabling defacement, cookie theft, or session hijacking. The flaw stems from improper neutralization of user input during page generation, a classic stored XSS scenario. No escalation of system privileges is achieved; the impact is confined to victim browsers. The listed weakness is CWE‑79.

WPVibes AnyWhere Elementor plugin, versions up to and including 1.3.0. The affected range is from the earliest release through 1.3.0. Users running 1.3.1 or later are not impacted.

The CVSS score of 6.5 marks this as a moderate‑severity issue. The EPSS score is unavailable, and it is not listed in CISA KEV, suggesting limited pre‑existing exploitation activity. Attackers would need to supply input via the plugin’s interface; therefore the likelihood of exploitation depends on the plugin’s usage and exposure. Given the web‑based nature of the vulnerability, the principal vector is a web application, and the attack can be performed by unauthenticated or authenticated users if the plugin accepts input from those user types.