The Elementor Website Builder plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the Typography Settings. Authenticated users with contributor or higher privileges can inject arbitrary scripts that persist in pages and execute upon page access by other users. This vulnerability affects all versions up to 3.25.9. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or official fix details are currently available.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages, which execute in the context of users viewing those pages. This can lead to unauthorized actions such as session hijacking or data theft limited to the confidentiality and integrity of affected users. There is no reported impact on availability. The vulnerability requires authenticated access, limiting exposure to users with some level of trust in the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider additional input validation or content filtering controls if possible. Monitor official Elementor communications for updates regarding patches or mitigations.