The plugin contains a stored cross-site scripting flaw that allows an attacker to insert malicious JavaScript into content fields that are later rendered on visitor pages. If exploited, the script runs in the browser context of any user viewing the affected page, enabling session hijacking, credential theft, defacement, or redirection to malicious sites. This poses a significant risk to confidentiality, integrity, and availability for sites that publish content through the widget or editor.

The vulnerability impacts the WPBITS Addons For Elementor Page Builder plugin supplied by wpbits. Any installation of version 1.8.1 or earlier is susceptible; later versions are presumed fixed. Sites using this plugin on WordPress are at risk.

The likely attack vector involves an authenticated or otherwise privileged user submitting malicious content via the plugin’s editor or widget fields, which is stored and later rendered to all visitors. No EPSS score or KEV status is available, but stored XSS is generally considered a severe risk due to its ability to affect every page visitor without additional action. The absence of a public patch in the CVE record indicates that updating to a version newer than 1.8.1 is necessary; until such a patch is applied, the vulnerability remains exploitable.