The Elementor Website Builder Pro plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) via the video_html_tag attribute in versions up to 3.20.1. This vulnerability allows authenticated users with contributor or higher privileges to inject arbitrary web scripts into pages. These scripts execute in the context of any user who accesses the affected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is due to insufficient sanitization and escaping of user input before rendering on web pages. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

An attacker with contributor or higher privileges can inject persistent malicious scripts into pages via the vulnerable attribute. This can lead to unauthorized actions performed in the context of users who view the infected pages, such as session theft or defacement. The impact is limited by the requirement for authenticated access with contributor-level permissions, and there is no indication of denial of service or privilege escalation beyond the injection capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the video_html_tag feature. Monitor for updates from Elementor regarding patches or official mitigations.