The Elementor Website Builder Pro plugin suffers from a stored XSS vulnerability due to improper neutralization of user-supplied input in the Post Navigation widget. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users viewing the affected pages. This vulnerability is present in all versions up to 3.20.1. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, and limited impact on confidentiality and integrity. No patch or vendor advisory confirming remediation is currently available.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level permissions to trusted users only and consider disabling or limiting use of the Post Navigation widget. Monitor official Elementor communications for updates and patches addressing this vulnerability.