The Premium Addons PRO plugin for WordPress, version 2.9.12 and earlier, contains a stored cross-site scripting vulnerability (CWE-79) in its Premium Magic Scroll module. This vulnerability allows authenticated users with contributor-level privileges or above to inject arbitrary web scripts due to improper input sanitization and output escaping during page generation. When other users access the injected pages, the malicious scripts execute, potentially compromising user interactions or session data. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, and privileges required at the contributor level. No patch or remediation details are currently available from the vendor.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Premium Magic Scroll module. Monitor for updates from the plugin vendor and apply patches promptly once available.