The Premium Addons for Elementor plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in its Video Box widget due to improper neutralization of input during web page generation. Authenticated attackers with contributor-level privileges or higher can inject arbitrary scripts that execute in the context of users visiting the affected pages. This vulnerability affects all versions up to 4.10.60. The CVSS 3.1 base score is 6.4 (medium severity), with network attack vector, low attack complexity, and no user interaction required. The impact includes partial confidentiality and integrity loss but no availability impact. No patch or official fix is currently documented.

An attacker with contributor-level or higher access can inject malicious scripts into pages via the Video Box widget, leading to stored XSS. This can result in the execution of arbitrary scripts in the context of users viewing the affected pages, potentially compromising user data confidentiality and integrity. There is no impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the Video Box widget in the Premium Addons for Elementor plugin. Monitor vendor channels for updates and apply patches promptly once available.