The Element Pack Elementor Addons plugin for WordPress contains a stored XSS vulnerability (CWE-79) in the Custom Gallery Widget's 'image_title' parameter. Authenticated attackers with Contributor or higher privileges can inject arbitrary JavaScript due to improper input neutralization and output escaping. This vulnerability affects all versions up to and including 5.10.1. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity with scope changed. No patch or official fix has been documented in the provided data.

An attacker with Contributor-level access or higher can inject persistent malicious scripts into pages via the 'image_title' parameter. These scripts execute in the context of users viewing the compromised pages, potentially leading to unauthorized actions or data disclosure limited to the confidentiality and integrity impact as per the CVSS vector. There is no reported impact on availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Custom Gallery Widget. Monitor for updates from bdthemes regarding patches or official mitigations.