The ElementsKit Elementor Addons plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the Countdown Timer Widget's ekit_countdown_timer_title parameter. This flaw allows authenticated attackers with Contributor-level privileges or above to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the compromised pages, potentially leading to data theft or session hijacking. The vulnerability affects all versions up to 3.4.7. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity but not availability. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into WordPress pages using the vulnerable widget. When other users visit these pages, the injected scripts execute in their browsers, potentially compromising user data or site integrity. The impact affects confidentiality and integrity but not availability. Since the vulnerability requires authenticated access, the risk is limited to environments where such user roles exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable Countdown Timer Widget. Monitor for plugin updates from roxnor and apply them promptly once released.