The vulnerability is a stored cross‑site scripting flaw in the Themesflat Add‑ons for Elementor WordPress plugin. The plugin fails to neutralize user‑supplied input during page rendering, enabling an attacker to embed malicious JavaScript that will execute in the browsers of anyone who views a page that includes the tainted content. This can lead to session hijacking, defacement, and redirection, compromising the confidentiality and integrity of site users.

WordPress sites running the Themesflat Add‑ons for Elementor plugin from any version up to and including 2.3.2 are affected. The product is offered by Themesflat under the name "themesflat-addons-for-elementor."

The vulnerability carries a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1 %, signifying a low probability of exploitation. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker submitting malicious input via the plugin’s content or custom widget features; the stored script is then rendered to site visitors when the affected pages are displayed.