The Essential Addons for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper input validation (CWE-20) in the eael_team_members_image_rounded parameter of the Team Members widget. This allows authenticated users with contributor-level access or higher to inject arbitrary web scripts that execute upon page access by other users. The vulnerability affects all versions up to and including 5.9.15. It has a CVSS 3.1 base score of 6.4, indicating medium severity. No patch or remediation details are currently available from the vendor or advisory sources.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, potentially leading to unauthorized actions or data exposure for users viewing those pages. The impact includes limited confidentiality and integrity loss but no availability impact. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the affected Team Members widget to reduce risk.