The Essential Addons for Elementor Pro plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the Counter widget's 'title_html_tag' attribute. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript that executes in the context of other users viewing the page. The vulnerability affects all versions up to and including 5.8.11. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation enables authenticated contributors or higher to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to information disclosure or session hijacking limited to the privileges of the affected users. There is no indication of denial of service or system-level compromise. The impact is limited by the requirement for authenticated access at contributor level or above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Counter widget in Essential Addons for Elementor Pro. Monitor for updates from the vendor regarding patches or official mitigations.