A stored XSS flaw exists when the Elementor Website Builder plugin for WordPress does not properly neutralize input that is included in generated web pages. A crafted payload can be stored in a post, widget or other content element and subsequently executed in the browsers of any visitor to the affected page, allowing an attacker to hijack sessions, deface the site or deliver phishing attacks. The weakness is characteristic of CWE‑79, where input validation or output escaping is insufficient.

All WordPress sites that use the Elementor Website Builder plugin version 4.3.5 or earlier are affected. The vulnerability is limited to the plugin itself and does not extend beyond its custom widgets or content fields.

The CVSS score of 6.5 indicates a medium severity risk. Because the EPSS score is not available, the likelihood of exploitation is unknown but the flaw is a stored XSS, which is typically easier to exploit than reflected variants. The issue is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation, however an attacker could easily craft a malicious payload if active users are present.