A stored cross‑site scripting flaw exists in the ElementsKit Elementor Addons and Templates plugin for WordPress. The short‑tab widget accepts an "ekit_tab_title" value that is stored without proper sanitization or escaping. When a page containing the tab is viewed by any user, the injected script runs in their browser, enabling the attacker to steal credentials, perform actions on the victim’s behalf, or compromise site integrity. The weakness is described by CWE‑79: Improper Neutralization of Input During Web Page Generation.

The impacted product is ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor, supplied by roxnor. All releases up to and including version 3.7.9 are vulnerable. Versions 3.8.0 and newer contain the fix and therefore are not affected.

The CVSS score of 6.4 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog, suggesting low current exploitation prevalence. However, the flaw requires only authenticated contributor access, a privilege commonly granted to site editors, and affects any visitor who views the malicious tab. Consequently, an attacker with contributor rights can compromise user sessions and the site’s reputation with minimal effort.