WordPress sites that have installed the WPBITS Addons For Elementor Page Builder plugin up to and including version 1.8.1 are vulnerable to a stored cross‑site scripting flaw. Improper neutralization of user input during page generation allows an attacker to embed arbitrary JavaScript that will execute whenever a page containing the plugin is viewed. This can lead to session hijacking, credential theft, site defacement, or covert phishing attacks.

The flaw impacts the WPBITS Addons For Elementor Page Builder plugin for WordPress, covering all releases through version 1.8.1. Site administrators using this plugin on any WordPress instance are at risk.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score under 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, implying it is not currently known to be actively exploited. Attackers would typically supply malicious input via the plugin’s content or editor fields, resulting in stored scripts that are then served to all visitors. The likely attack vector is the plugin’s public or admin‑visible input interfaces.