The nicheaddons Medical Addon for Elementor plugin versions up to 1.6.4 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with at least low privileges and requiring user interaction to inject malicious scripts that execute in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with a scope change and partial impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the browsers of users who view the affected content. This may lead to partial disclosure of sensitive information, modification of displayed content, or disruption of availability. The impact is limited by the need for user interaction and the requirement that the attacker has at least low privileges within the system. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with input handling and consider restricting privileges to trusted users. Monitoring for updates from the vendor nicheaddons is recommended to apply any forthcoming patches promptly.