The vulnerability exists in the Info Box widget of the Essential Addons for Elementor plugin for WordPress. Unsanitized user input and missing output escaping enable an authenticated user with contributor-level access to embed malicious scripts. These scripts run in the context of any user who visits a page that includes the compromised widget, exposing the site to cross‑site scripting attacks.

WordPress sites that use the Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin, particularly versions up to and including 6.5.9. All installations of the plugin that have not upgraded to version 6.5.10 or later are potentially affected.

The CVSS score of 6.4 indicates a moderate severity. The low EPSS score of less than 1% suggests that exploitation is currently unlikely at scale, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires only contributor‑level or higher authentication, which is a common capability on many WordPress sites. An attacker can inject arbitrary JavaScript that executes when a victim view the injected page, potentially leading to credential theft, session hijack, defacement, or other malicious actions.