The Clever Addons for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This affects the CAFE Icon, CAFE Team Member, and CAFE Slider widgets in all versions up to 2.1.9. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows authenticated users with contributor-level access or above to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity of the site and its users. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the affected widgets (CAFE Icon, CAFE Team Member, and CAFE Slider) to reduce risk. Monitor vendor channels for updates and apply patches promptly once released.