The Premium Addons for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its Countdown Widget. This occurs because user-supplied attributes are not properly sanitized or escaped before being rendered on web pages. Authenticated attackers with contributor-level permissions or higher can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. This vulnerability affects all plugin versions up to 4.10.24. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the contributor level, no user interaction, and partial impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary scripts in the context of users visiting the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or modification of page content. There is no impact on system availability. The vulnerability requires authenticated access, limiting the attack surface to users with contributor-level permissions or above. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Countdown Widget if feasible. Monitor for updates from the vendor leap13 regarding patches or official mitigations.