The Elementor Addon Elements plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the 'button1_icon' attribute of its Dual Button widget. Authenticated users with contributor-level privileges or higher can inject arbitrary web scripts due to insufficient input sanitization and output escaping. This vulnerability affects all plugin versions up to 1.12.12 inclusive. When a page containing the injected script is accessed, the malicious code executes in the context of the user’s browser session, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4, reflecting a medium impact with network attack vector, low attack complexity, and no user interaction required. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

An authenticated attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable 'button1_icon' attribute. These scripts execute in the browsers of users who view the compromised pages, potentially allowing theft of sensitive information or session tokens. The vulnerability does not impact availability and requires some level of privilege, limiting its scope. The medium CVSS score reflects the moderate risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if feasible. Monitor for updates from the vendor (wpvibes) regarding patches or official mitigations.