The Premium Addons for Elementor plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the button onclick attribute. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users viewing the affected pages. This vulnerability affects all plugin versions up to and including 4.10.18. The CVSS 3.1 base score is 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. No patch or official fix has been documented in the provided data.

Successful exploitation allows an attacker with contributor or higher privileges to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or session hijacking. The impact affects confidentiality and integrity but does not affect availability. Since the attacker must have authenticated access with contributor or higher privileges, the risk is limited to environments where such user roles exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor and higher privileges to trusted users only. Review and sanitize user-generated content manually to prevent injection of malicious scripts. Consider disabling or limiting the use of the vulnerable button onclick attribute if possible. Monitor plugin updates from leap13 for an official patch or mitigation.