This vulnerability in Black Widgets For Elementor involves improper input sanitization leading to stored XSS. An attacker with low privileges can inject malicious scripts that execute in the context of users who view the affected content, potentially impacting confidentiality, integrity, and availability to a limited extent. The vulnerability affects all versions up to 1.3.5. No official fix or patch has been published yet, and the vendor has not provided remediation details.

Successful exploitation could allow an attacker to execute arbitrary scripts in the browsers of users who view the compromised content, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting access to trusted users and monitoring for suspicious activity related to the plugin. Avoid exposing the vulnerable plugin on public-facing sites where possible.