The Element Pack Addons for Elementor plugin fails to sanitize option values that are passed through certain data attributes. This flaw allows contributors or higher‑privileged users to inject arbitrary JavaScript that is executed in the browser of any visitor who views the affected content. The injection is stored, meaning the malicious script persists with the content and runs each time the page is rendered, potentially leading to credential theft, session hijacking, or distribution of malware.

Any WordPress site that uses the Element Pack Addons for Elementor plugin with a version older than 8.7.13 is vulnerable. The issue affects all installations regardless of theme, as the plugin’s bundled front‑end library processes the data attributes unfiltered.

The EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, indicating a relatively low exploitation probability at the time of this assessment. The CVSS score of 6.8 indicates medium severity. Based on the description, the likely attack vector is an attacker who becomes a contributor or has write access to content can inject malicious data attributes via the plugin’s admin interface. Once injected, the stored script executes in every visitor’s browser, providing the attacker with the ability to run arbitrary JavaScript in the context of the site’s domain.