The Rife Elementor Extensions & Templates plugin for WordPress contains a stored XSS vulnerability due to improper neutralization of user-supplied input in the Writing Effect Headline shortcode. Authenticated attackers with contributor-level permissions or above can inject arbitrary web scripts that persist in pages and execute in the context of users visiting those pages. This vulnerability affects all plugin versions up to and including 1.2.5. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at contributor level, no user interaction, and impacts on confidentiality and integrity with no impact on availability. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to partial confidentiality and integrity loss, such as theft of session tokens or unauthorized actions performed on behalf of users. Availability is not impacted. The vulnerability requires authenticated access with contributor privileges, limiting the attack surface to users with some level of trust in the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the Writing Effect Headline shortcode if feasible. Monitor for updates from apollo13themes regarding patches or official mitigations.