The vulnerability is a DOM‑Based Cross‑Site Scripting flaw as described in the CVE_DESCRIPTION, classified by CWE‑79. An attacker can inject malicious JavaScript that executes within the victim’s browser when visiting a page that includes the content injected via Elementor. The malicious code can read cookies, hijack sessions, redirect users, or perform other client‑side attacks. The severity is moderate with a CVSS base score of 6.5.

Affected the Elementor Website Builder plugin for WordPress; all versions up to and including 3.35.5 (inclusive) are vulnerable. No specific sub‑versions are listed, so any deployment using a version ≤3.35.5 should remediate.

The EPSS score indicates a low likelihood of exploitation (<1%). However, because XSS can provide attackers with a broad range of malicious actions, the risk remains non‑negligible. No entry in the KEV catalog suggests no known public exploits yet, but the moderate CVSS score indicates that, if exploited, the impact could be significant to site visitors. Attack likely occurs when a user with posting rights injects content or when the plugin fails to sanitize input on page generation.