The vulnerability is a Cross Site Scripting flaw that exists in The Plus Addons for Elementor Page Builder Lite plugin versions 6.5.1 and earlier. An attacker can inject malicious JavaScript into the contributor input field, causing the script to run when the website is viewed by authenticated or unauthenticated users. The impact is that an attacker could steal session cookies, deface the site, or redirect users to phishing domains. The flaw aligns with CWE-79, indicating that user-supplied input is unsanitized and can be rendered as executable code.

Vulnerable installations are those that use the WordPress The Plus Addons for Elementor Page Builder Lite plugin version 6.5.1 or earlier. The defect affects WordPress sites that have the addon active, regardless of the user role, because the input is processed during comment submission. Admins, editors, writers, and even guest contributors that can post content may be impacted. The issue resides in the plugin code and not the core WordPress software.

The CVSS base score of 6.5 indicates a medium severity risk, and the lack of an EPSS score means there is no publicly documented exploitation probability. The flaw is not listed in the CISA KEV catalog, which suggests there are no known large‑scale incidents tied to it. Attackers must gain access to the contributor submission interface or lure a user to submit a comment, which is a conventional XSS attack path. In the absence of additional constraints, a casual attacker could potentially exploit the flaw by crafting a malicious comment, which will run in anyone’s browser that views the affected page.