The RT Easy Builder – Advanced addons for Elementor WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code via plugin widgets. The injected scripts execute in the context of any user who accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to 2.3. No known exploits are reported in the wild, and no patch or official fix has been documented yet.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to information disclosure such as session tokens or other user data accessible via script, and potentially further attacks depending on the injected payload. The vulnerability does not impact availability and requires at least contributor-level privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the affected plugin. Monitor for plugin updates from risetheme and apply them promptly once available.