The vulnerability allows an authenticated user with contributor-level access to inject arbitrary scripts into site pages through the Fancy Text Widget. Because the input is not properly sanitized or escaped, the injected code is stored and executed whenever the affected page is viewed, leading to potential data theft, defacement, or further compromise. The flaw is a classic instance of Stored XSS (CWE‑79).

The plugin Essential Addons for Elementor – Popular Elementor Templates & Widgets, all releases up to and including version 6.6.11, runs within WordPress sites.

The CVSS score of 6.4 classifies the flaw as moderate, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not currently listed in CISA's KEV catalog. Attackers would need to log into the WordPress admin interface with contributor‑level or higher privileges, create or edit a page using the Fancy Text Widget, and store malicious script content. Once stored, any visitor to the affected page will execute the injected code. The impact is limited to the scope of the page content but can affect all users who view the page and potentially expose site‑wide secrets if the site’s policy allows scripts to access sensitive information.