The Royal Elementor Addons and Templates plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts via element URL parameters because the plugin fails to properly sanitize and escape these inputs. This vulnerability affects all versions up to 1.3.87. Exploitation results in script execution in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. No known exploits in the wild have been reported, and no patch or official fix information is currently provided.

An attacker with contributor or higher privileges can inject malicious scripts that execute in the browsers of users who view the infected pages. This can lead to theft of user credentials, session tokens, or other sensitive information accessible via the browser context. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS score of 6.4 reflects a medium severity level with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable plugin. Monitor for plugin updates from wproyal that address this vulnerability and apply them promptly once released.