The Elementor Addon Elements plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in its Twitter Widget component. This flaw allows authenticated users with contributor-level or higher privileges to inject arbitrary web scripts due to improper neutralization of user-supplied input during page generation. The vulnerability affects all versions up to and including 1.13.3. Exploitation results in script execution in the context of users visiting the affected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 5.4 (medium), with attack vector network, low attack complexity, privileges required (low), no user interaction, and impacts on confidentiality and integrity but not availability. There is no indication of an official patch or vendor advisory at this time.

An authenticated attacker with contributor-level or higher permissions can inject malicious scripts into pages via the vulnerable Twitter Widget. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to unauthorized actions such as data theft or session hijacking. The impact is limited to confidentiality and integrity, with no direct availability impact. The vulnerability requires authenticated access, reducing the attack surface compared to unauthenticated vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the Twitter Widget feature if possible. Monitor for updates from the plugin vendor (wpvibes) regarding patches or official mitigations.