Based on the description, it is inferred that the vulnerability is a contributor cross‑site scripting flaw in the WordPress Ultimate Addons for Elementor plugin. Attacks occur when a contributor submits data that contains malicious script, which the plugin stores and later renders without proper sanitization. This allows the injected script to execute in the web browser of any visitor to the affected site when the stored content is displayed.

WordPress sites that have installed or updated the Brainstorm Force Ultimate Addons for Elementor plugin and are running version 1.45.2 or older are affected. Sites with any contributor input features enabled in the plugin are at risk.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the flaw is exploitable from the client side through the plugin’s handling of untrusted contributor data; no privileged access or server configuration changes are required. Based on the description, it is also inferred that an attacker only needs to submit malicious input via a legitimate contributor submission interface.