The Prime Elementor Addons plugin for WordPress is impacted by a stored cross‑site scripting flaw (CWE‑79). During widget creation, the plugin accepts HTML tag settings without adequate sanitization or escaping, allowing an authenticated contributor or higher to inject malicious script payloads that lack angle brackets and therefore bypass Elementor’s wp_kses_post() filter. The injected code executes in the browsers of any user who views the affected page, potentially exposing page visitors to phishing, cookie theft, or arbitrary code execution.

All WordPress installations running Prime Elementor Addons version 1.3.3 or earlier are affected. The plugin is published by wpmessiah under the name Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages.

The vulnerability scores a CVSS of 6.4, indicating moderate severity. Although no EPSS score is publicly available, the requirement of contributor‑level access limits the attacker set to users with editing rights. The flaw is not listed in the CISA KEV catalog. An attacker with appropriate permissions can inject scripts that will run in the browsers of all site visitors, compromising confidentiality and integrity of the site content.