The ElementsKit Elementor Addons plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) in its Image Comparison Widget due to improper neutralization of user-supplied input during web page generation. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code that executes in the context of users viewing the affected pages. This vulnerability affects all versions up to and including 3.2.9. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages via the Image Comparison Widget. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content when other users access the infected page. There is no direct impact on availability. The vulnerability requires authenticated access with contributor-level privileges, limiting the attack surface to users with some level of trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the Image Comparison Widget in ElementsKit Elementor Addons. Monitor vendor channels for updates and apply patches promptly once released.