The vulnerability allows authenticated WordPress users with contributor or higher privilege in the Premium Addons for Elementor plugin to inject arbitrary JavaScript through the 'custom_svg' parameter. Stored cross‑site scripting means the malicious code is saved within the plugin’s content and executed whenever any site user views the affected page. This can lead to session hijacking, credential theft, defacement, or other client‑side attacks on visitors drawing from the compromised site.

WordPress sites running the leap13 Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin, versions 4.11.70 or earlier. No other vendors or products are affected according to the provided CNA data.

The CVSS score of 5.4 classifies the flaw as moderate; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only contributor‑level access or higher, making it relatively easy for an attacker who has already gained credentials or has compromised the site’s admin account to inject malicious scripts by uploading a custom SVG. The impact is confined to site visitors who trigger the injected page, but the effect can be widespread across all users of the affected WordPress installation.