The Premium Addons for Elementor plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in the 'subcontainer' value parameter due to inadequate input sanitization and output escaping. This flaw allows authenticated users with contributor or higher privileges to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the affected page, potentially compromising user sessions or data. The vulnerability affects all versions up to and including 4.10.28 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No patch or vendor advisory is currently provided, and no known exploits have been reported.

An attacker with contributor or higher privileges can inject persistent malicious scripts into pages via the vulnerable parameter. This can lead to unauthorized actions performed in the context of other users viewing the page, including theft of session tokens or other sensitive information. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authenticated access, reducing the attack surface somewhat.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider monitoring for suspicious activity related to page content modifications. Avoid exposing pages with untrusted content to high-privilege users. Follow vendor channels for updates on patches or official mitigations.