The Premium Addons for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-0326. This vulnerability exists due to improper neutralization of user-supplied input in the Link Wrapper feature, which fails to sanitize and escape inputs adequately. Authenticated attackers with contributor-level or higher privileges can inject arbitrary JavaScript code that executes in the context of users viewing the affected pages. The vulnerability affects all plugin versions up to 4.10.17. The CVSS 3.1 score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. There is no indication of an official patch or vendor advisory at this time.

An authenticated user with contributor-level or higher permissions can inject malicious scripts into pages via the Link Wrapper functionality. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level permissions to trusted users only. Consider disabling or restricting use of the Link Wrapper functionality if possible. Monitor official leap13 and WordPress security channels for updates and apply patches promptly once available.