The Premium Addons PRO plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'premium_fbchat_app_id' parameter in the Messenger Chat Widget. This vulnerability allows authenticated users with contributor-level privileges or higher to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the compromised page, potentially leading to information disclosure or session hijacking. The issue arises from insufficient input sanitization and output escaping in versions up to 2.9.12. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. No patch or remediation details are currently available.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable parameter. This can lead to the execution of arbitrary scripts in the context of users viewing the affected pages, potentially resulting in information disclosure or other impacts related to cross-site scripting. The vulnerability does not affect availability and requires authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Messenger Chat Widget feature if feasible to reduce exposure.