The vulnerability is a stored cross‑site scripting flaw in the Tim Strifler Exclusive Addons Elementor plugin that allows attackers to inject malicious JavaScript into the plugin’s content fields. When that content is rendered on a user’s browser, the injected script executes with the privileges of the visiting user, enabling defacement, credential theft, or session hijacking. The weakness corresponds to CWE‑79 and can affect the confidentiality, integrity, and availability of site visitors.

All releases of the WordPress Exclusive Addons Elementor plugin up to and including version 2.7.9.8 are affected. The product is a WordPress extension by Tim Strifler that provides additional widgets for the Elementor page builder, allowing site administrators to store arbitrary content that is later rendered on public pages.

The CVSS score of 6.5 indicates a moderate risk level. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker with access to the Elementor admin interface who can input malicious code into widget content. Once installed, the code runs in the context of any visitor to the affected page, making the vulnerability meaningful to attackers and potentially exploitable through common web‑application attack workflows.