The Elementor Addon Elements plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input in the 'url' parameter. Authenticated users with contributor or higher privileges can inject arbitrary web scripts into pages, which execute upon page access by any user. This vulnerability is tracked as CVE-2024-4570 and has a CVSS 3.1 base score of 6.4 (medium severity). The issue is caused by insufficient input sanitization and output escaping in versions up to and including 1.13.5. No vendor patch or remediation details are provided in the available data.

An attacker with contributor-level or higher permissions can inject malicious scripts that execute in the context of users viewing the compromised pages. This can lead to information disclosure or session hijacking limited to the scope of the injected scripts. The vulnerability does not affect availability and requires authenticated access, reducing the overall impact severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider removing or disabling the vulnerable plugin to prevent exploitation.