Unauthenticated attackers can inject arbitrary JavaScript into page output via the Ansar Import – One Click Starter Sites – for Elementor & Themes plugin. The vulnerability stems from unsanitized user content being echoed, allowing code execution in the victim’s browser. This weakness is a classic reflected XSS and is identified as CWE‑79. Resulting impacts include possible credential theft, session hijacking, defacement, or distribution of malware to site visitors.

WordPress sites running the Ansar Import – One Click Starter Sites – for Elementor & Themes plugin, versions 2.1.2 and earlier. The attack vector depends solely on the presence of this plugin; no additional software is required.

With a CVSS base score of 7.1, this issue has moderate to high severity. Its EPSS score of 0.00191 indicates a very low but nonzero probability of exploitation, and it is not listed in CISA’s KEV catalog. The vulnerability requires no authentication and does not need privileged access, making exploitation relatively straightforward for an attacker who can persuade a user to visit a crafted page or can compel a script execution via another plugin or theme that passes data to Ansar Import. The scope is limited to the affected WordPress site, but any compromised user session can be leveraged for broader attacks on the network.