The Elementor Website Builder Pro plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, SVGZ files uploaded through the Form widget are not properly sanitized or escaped, enabling authenticated users with contributor or higher privileges to inject arbitrary web scripts. These scripts execute when any user accesses the affected page. The vulnerability is limited to environments where the web server is NGINX; Apache HTTP Server environments are not vulnerable. The CVSS 3.1 base score is 6.4 (medium), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with contributor-level access or higher can exploit this vulnerability to inject and store malicious scripts within pages built using Elementor Website Builder Pro. These scripts execute in the context of users visiting the affected pages, potentially leading to unauthorized actions or data disclosure limited to the confidentiality and integrity of the affected site. The vulnerability does not impact availability. Exploitation requires authenticated access and is constrained to NGINX web server environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling SVGZ file uploads via the Form widget if possible. Monitor Elementor's official channels for updates and patches addressing this vulnerability.