The Premium Addons PRO plugin for Elementor is vulnerable to stored XSS via the IHover widget link. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing authenticated contributors or higher to inject arbitrary scripts. This occurs because the plugin fails to adequately sanitize and escape input attributes, leading to script execution in the context of users viewing the compromised pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages using the vulnerable widget. These scripts execute in the browsers of users who visit the infected pages, potentially leading to theft of sensitive information, session hijacking, or other client-side attacks. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or avoiding use of the IHover widget link feature. Monitor vendor channels for updates and apply patches promptly once released.