The Elementor Website Builder plugin for WordPress versions up to 3.21.5 contains a DOM-based stored cross-site scripting vulnerability (CWE-79) via the 'hover_animation' parameter. Authenticated attackers with contributor-level permissions or above can inject malicious scripts due to inadequate input sanitization and output escaping. These scripts execute in the context of users who visit the compromised pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity but not availability. No official patch or vendor advisory is provided, and no known exploits are reported.

Successful exploitation allows authenticated users with contributor-level permissions or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed on behalf of users. Availability is not impacted. The vulnerability requires authenticated access, limiting exposure to trusted users with certain permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider monitoring or limiting use of the 'hover_animation' parameter. Avoid granting unnecessary privileges to users who do not require them. Review and apply any future updates from Elementor addressing this vulnerability.