The vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that allows DOM‑Based XSS in the LA‑Studio Element Kit for Elementor plugin. An attacker can inject arbitrary script into content managed by the plugin, resulting in browser‑based execution when the affected page is viewed. This flaw falls under CWE‑79.

The issue affects all WordPress sites that have installed the LA‑Studio Element Kit for Elementor plugin version 1.6.2 or earlier. The vendor is LA‑Studio and the plugin is commonly integrated into WordPress sites via the Elementor page builder.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must be able to submit or edit content through the plugin’s editor to deliver malicious code, implying an authenticated or local access attack vector rather than a purely remote one.