The Thimpress Thim Kit for Elementor plugin suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the 'id' parameter is not properly sanitized or escaped, enabling authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of other users viewing the affected pages, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to 1.1.9. There is no information provided about an available patch or official remediation.

An attacker with contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who visit the infected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent, as reflected by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the Thimpress Thim Kit for Elementor plugin if possible. Monitor for plugin updates from the vendor that address this vulnerability.