The vulnerability allows an author or higher‑privileged user to upload an SVG file containing malicious JavaScript. The file is not sanitized upon upload, so when any user opens the SVG in a browser the script runs in that user’s context. This enables the attacker to hijack sessions, steal cookies, or perform other client‑side malicious actions. The weakness stems from improper input validation (CWE‑79).

WordPress sites running the Elementor Website Builder plugin older than version 4.3.5 are affected. Only users with the Author role or higher can exploit the flaw, and the plugin’s "unfiltered file uploads" setting must be enabled, which is not the default configuration.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests that exploitation is unlikely but still possible. The flaw is not listed in the CISA KEV catalog. Exploitation requires that the site owner has enabled unfiltered file uploads in the plugin settings, after which an attacker uploads a crafted SVG and tricks users to view it, triggering the stored XSS. The attack vector is inferred to be the plugin’s file upload interface and relies on the upload of a malicious SVG file. Inference: the attack requires the existence of a user with sufficient permissions to upload files and that the target users will open the SVG, which is probable in shared or public Elementor pages.