The PQ Addons – Creative Elementor Widgets plugin for WordPress allows authenticated users with contributor privileges or higher to submit an invalid html_tag parameter that is stored and later rendered without proper escaping. The stored payload is then executed in the browsers of any user who views the affected page, enabling the attacker to inject arbitrary JavaScript. This can lead to defacement, credential theft, drive‑by installation of malware or hijacking of the current user session. The weakness is a classic stored XSS, classified as CWE‑79.

The vulnerability exists in all releases up to and including version 1.0.0 of the PQ Addons – Creative Elementor Widgets plugin. Sites that have installed any of those versions, and that provide contributor or higher level access to users, are potentially exposed.

The CVSS base score of 6.4 indicates a moderate severity, but the requirement of only contributor‑level authentication lowers the practical barrier for exploitation on sites with loose role permissions. No public exploit is currently documented and the vulnerability is not listed in the CISA KEV catalog, yet the lack of input sanitization provides a straightforward attack path. The risk is highest for sites with many contributors or untrusted users, while sites that limit or revoke such permissions can mitigate the threat until a patch is applied.