The vulnerability arises from improper neutralization of input during web page generation in the Noor Alam Magical Addons For Elementor plugin. It allows an attacker to inject and store malicious JavaScript that executes when the page is viewed, resulting in a stored cross‑site scripting (XSS) flaw. This can compromise user confidentiality, integrity, and potentially allow attackers to deface content or steal session credentials.

The affected products are the Magical Addons For Elementor plugin for WordPress from the Noor Alam vendor, specifically all releases up to and including version 1.4.1. No specific sub‑versions are noted, so any installation of the plugin through version 1.4.1 is potentially vulnerable.

The CVSS score of 6.5 classifies the impact as medium, while an EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves sending maliciously crafted input through the plugin’s input fields, which requires a user capable of adding or editing content. Because the flaw is a stored XSS, it persists across sessions and can affect every visitor to the compromised page.