The Premium Addons for Elementor plugin for WordPress contains a stored XSS vulnerability (CWE-79) in its Fancy Text widget. This occurs because the plugin fails to properly sanitize and escape user input, allowing authenticated contributors or higher to inject arbitrary scripts into pages. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The issue affects all versions up to 4.10.31. Although version 4.10.32 fixes the vulnerability, it causes a fatal error, so users are advised to update to version 4.10.33 where the issue is resolved without errors.

An attacker with contributor-level or higher privileges can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who view the infected pages. This can lead to theft of user credentials, session tokens, or other malicious actions performed in the context of the victim's browser. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Users should update the Premium Addons for Elementor plugin to version 4.10.33, which contains the official fix for this stored XSS vulnerability without causing fatal errors. Avoid relying on version 4.10.32 due to its known fatal error. No other mitigations are specifically recommended by the vendor advisory. Patch status is confirmed as official-fix in version 4.10.33.