The Premium Addons for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its Global Tooltip widget. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code because the plugin fails to properly sanitize and escape user input attributes. This injected code executes in the context of any user who views the compromised page, potentially leading to information disclosure or session hijacking. The issue affects all versions up to 4.10.31. No patch or official fix information is provided in the available data.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the Global Tooltip widget. These scripts execute in the browsers of users who visit the affected pages, potentially leading to limited confidentiality and integrity impacts such as theft of user data or session tokens. The vulnerability does not affect availability. The CVSS vector indicates network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the Global Tooltip widget. Monitor official leap13 or WordPress plugin sources for updates or patches addressing this vulnerability.