The Premium Addons Pro for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its maps widget due to improper neutralization of user-supplied input during web page generation. Authenticated attackers with contributor-level privileges or above can inject arbitrary scripts that execute in the context of users visiting the affected pages. This vulnerability affects all premium versions up to and including 4.10.30. No patch or official fix information is provided in the available data.

Successful exploitation allows an authenticated user with contributor-level access or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure and limited integrity impact but does not affect availability. The vulnerability requires user interaction to trigger the script execution and privileges to inject the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable maps widget in the premium addon. Monitor for vendor updates regarding patches or official mitigations.