The Qi Addons For Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This vulnerability allows authenticated users with contributor-level or higher permissions to inject arbitrary JavaScript into pages via plugin widgets. The injected scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other malicious actions. The vulnerability affects all versions up to 1.6.7. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages using the vulnerable plugin widgets. These scripts execute in the browsers of users who view the infected pages, potentially compromising user sessions or data confidentiality and integrity. The vulnerability does not affect availability. Since the attacker must be authenticated with contributor or higher permissions, the risk is limited to environments where such user roles exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released by qodeinteractive, limit contributor-level access to trusted users only. Monitor plugin updates closely and apply any security updates promptly once available. Consider removing or disabling the Qi Addons For Elementor plugin if contributor-level users cannot be fully trusted or if the plugin is not essential.