The Element Pack Elementor Addons plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) in the Price List widget's ‘link’ attribute due to improper input neutralization. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users viewing the affected pages. This vulnerability impacts all versions up to 5.6.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts on confidentiality and integrity with no availability impact. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows authenticated attackers with contributor-level access or higher to inject malicious scripts that execute in users' browsers when they visit the compromised pages. This can lead to unauthorized actions such as session hijacking or data theft limited to the scope of the affected site. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the affected Price List widget if possible. Monitor for updates from bdthemes regarding a security patch.