WP Smart Widgets Better Post & Filter Widgets for Elementor plugin has an improper neutralization of input that allows attackers to inject JavaScript code into pages. The vulnerability permits stored XSS, meaning the malicious payload can be saved in the site’s database and executed whenever the content is rendered. An attacker could thus hijack user sessions, steal cookies, deface the site, or redirect users to malicious sites. This flaw aligns with CWE‑79 – Improper Neutralization of Input During Web Page Generation.

The plugin WP Smart Widgets Better Post & Filter Widgets for Elementor, for versions up to and including 1.9.1, is affected. Anyone running these versions or earlier should be aware that the plugin can store unescaped user input.

The CVSS score of 6.5 indicates moderate severity. Because the exploit is a stored XSS, it generally requires the attacker to submit malicious input through the plugin’s interface, which may be limited to authenticated users but can be abused by site administrators or content editors. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Potential impact includes client‑side script execution in the context of the website, leading to credential theft, defacement, or redirection. The attack vector is inferred from the description as a stored XSS via the plugin’s content fields.