The Pack Elementor addons by Webangon, versions up to 2.0.8.3, contain a CSRF vulnerability (CWE-352) that enables Cross-Site Scripting (XSS) attacks. This occurs because the addon does not adequately verify the origin of requests, allowing attackers to trick authenticated users into executing unwanted actions. The vulnerability is network exploitable without privileges and requires user interaction. The CVSS 3.1 vector indicates low attack complexity, no privileges required, but user interaction is necessary, and the vulnerability impacts confidentiality, integrity, and availability at a low level.

Successful exploitation of this vulnerability could allow attackers to execute unauthorized actions on behalf of authenticated users, potentially leading to Cross-Site Scripting attacks. This can result in partial compromise of user data confidentiality, integrity, and availability within the affected addon context. However, there are no reports of active exploitation in the wild.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, consider disabling or limiting use of The Pack Elementor addons if feasible. Avoid interacting with untrusted links or sites that could exploit this vulnerability.