The vulnerability is an Improper Neutralization of Input During Web Page Generation that allows a DOM‑Based Cross‑Site Scripting (XSS) attack. An attacker could inject malicious scripts into page content viewed by other users, potentially leading to session hijacking, credential theft, or defacement. The weakness is identified as CWE‑79, indicating that user input was not properly validated or encoded before being rendered in the browser, compromising confidentiality and integrity of user sessions.

The affected software is the WordPress plugin Master Addons for Elementor developed by Liton Arefin. Versions from the initial release (n/a) up to and including 2.1.3 are vulnerable, so any WordPress site running the plugin at these versions is at risk.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of less than 1% suggests low exploitation probability currently. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, meaning there is no confirmed active exploitation. Likely attack vector is through a user’s browser when viewing a page that incorporates the vulnerable plugin; the attacker requires the victim to access the page to execute the injected script.