The Plus Addons for Elementor plugin for WordPress is vulnerable to stored cross-site scripting via the 'Countdown' widget's 'text_days' attribute due to improper input sanitization and output escaping. Authenticated users with contributor or higher privileges can inject arbitrary scripts that execute when the page is accessed. This vulnerability affects all versions up to and including 5.6.1. The CVSS 3.1 base score is 6.4 (medium severity), with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity but not availability.

An attacker with contributor-level access or higher can inject malicious JavaScript code into pages via the vulnerable widget. This code executes in the context of users viewing the page, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity of user data, with no direct availability impact. Since the attacker must be authenticated with contributor or higher privileges, the risk is mitigated somewhat by access controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the vulnerable 'Countdown' widget. Monitor for updates from posimyththemes regarding patches or official mitigations.