The Elementor Website Builder Pro plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the widget's custom_id attribute. Authenticated attackers with contributor-level or higher permissions can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. This vulnerability affects all versions up to and including 3.20.1. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact.

Successful exploitation allows an attacker with contributor-level or higher privileges to inject persistent malicious scripts into pages built with Elementor Website Builder Pro. This can lead to unauthorized actions performed on behalf of users who view the infected pages, potentially compromising user confidentiality and integrity of the site content. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the Elementor vendor advisory for updates and apply any forthcoming official patches promptly. Until a fix is released, restrict contributor-level permissions to trusted users only and consider additional input validation or filtering controls if feasible.