The Elementor Website Builder plugin for WordPress suffers from a reflected XSS vulnerability due to improper neutralization of input in the $instance[alt] parameter used in the get_image_alt function. This allows authenticated users with contributor or higher roles to inject malicious scripts that execute in the context of other users, potentially leading to session hijacking or other script-based attacks. The issue affects all versions up to and including 3.18.3. The CVSS 3.1 base score is 6.4, indicating medium severity, with attack vector network, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows an authenticated contributor or higher user to inject and execute arbitrary JavaScript in the context of other users visiting the affected pages. This can lead to information disclosure or session hijacking. The vulnerability does not impact availability and requires user interaction (clicking a crafted link). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level access to trusted users only and educate users to avoid clicking suspicious links. Monitor official Elementor channels for updates and apply patches promptly once available.