This vulnerability (CVE-2026-65503) is a CWE-79 cross-site scripting issue affecting Ultimate Store Kit Elementor Addons by bdthemes, specifically versions up to 3.0.5. The flaw arises from improper input neutralization during web page generation, which can be exploited by an attacker with low privileges and requiring user interaction to execute arbitrary scripts. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no official patch or remediation level has been published as of now.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The attack requires user interaction and low privileges, limiting the scope but still posing a risk to users and the application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input that can be rendered in web pages or applying web application firewall (WAF) rules to detect and block XSS attempts. Monitor vendor channels for updates and apply patches promptly once released.