The Premium Addons for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This allows authenticated users with contributor-level or higher privileges to inject malicious scripts via plugin widgets, which execute when the injected pages are accessed. The issue affects all versions up to 4.10.23 and requires the premium plugin version to be installed. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, potentially leading to unauthorized actions performed in the context of other users viewing those pages. This can result in limited confidentiality and integrity impacts but does not affect availability. The vulnerability requires authentication and the premium plugin version, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level permissions to trusted users only and consider disabling or uninstalling the Premium Addons for Elementor plugin if the premium version is installed. Monitor vendor channels for updates and apply patches promptly once available.