The Essential Addons for Elementor plugin for WordPress contains a stored XSS vulnerability (CWE-79) in its Login/Register element due to improper neutralization of input on the custom login URL. This allows authenticated users with contributor-level or higher privileges to inject arbitrary web scripts that execute in the context of other users viewing the injected pages. The vulnerability affects all versions up to 5.9.4. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official fix is currently documented, and no known exploits have been reported.

An attacker with contributor-level or higher permissions can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to unauthorized actions performed on behalf of users, data theft, or session hijacking. The impact affects confidentiality and integrity but does not affect availability. Since the vulnerability requires authenticated access at contributor level or above, the attack surface is limited to users with such permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to limit contributor-level permissions to trusted users only. Monitor for updates from the plugin vendor and apply patches promptly once available. Consider disabling or restricting use of the Login/Register element if feasible.