The WPKoi Templates for Elementor plugin (versions up to 3.1.3) suffers from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This vulnerability allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability of affected systems. The CVSS 3.1 base score is 6.5, reflecting a medium severity. No patch or vendor advisory is currently referenced, and no known active exploitation has been reported.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected web application. An attacker could execute arbitrary scripts in the context of the affected site, potentially leading to session hijacking, defacement, or other malicious actions. However, exploitation requires user interaction and low privileges, which somewhat limits the impact scope. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input capabilities and applying web application firewall (WAF) rules to detect and block XSS payloads related to this plugin. Monitor vendor channels for updates and apply patches promptly once released.