The Stratum – Elementor Widgets WordPress plugin contains a stored cross-site scripting vulnerability in its Image Hotspot widget due to inadequate sanitization and escaping of user input. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript code that executes in the context of users viewing the affected pages. This vulnerability affects all versions up to and including 1.4.7. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and partial impact on confidentiality and integrity but no impact on availability. No patch or official remediation guidance is currently provided by the vendor.

Successful exploitation allows authenticated users with contributor-level access or higher to inject and execute arbitrary scripts in the context of other users visiting the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or unauthorized actions performed on behalf of other users. There is no reported impact on system availability. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only to reduce risk. Monitor for updates from the plugin vendor and apply any released patches promptly. Avoid using the vulnerable Image Hotspot widget if possible.