The Blog, Posts and Category Filter for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'post_types' attribute. This allows authenticated users with contributor or higher privileges to inject arbitrary web scripts into pages via the Post and Category Filter widget. These scripts execute in the context of users who visit the injected pages, potentially leading to information disclosure or session hijacking. The issue affects all versions up to and including 1.0.3. No known exploits are reported in the wild, and no patch or vendor advisory has been provided to confirm remediation status.

An attacker with contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages using the vulnerable widget. This can lead to unauthorized actions performed in the context of other users viewing the affected pages, including data theft or session compromise. The vulnerability does not impact availability but affects confidentiality and integrity. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Monitor plugin updates from plugindevs for a security patch addressing this vulnerability. Avoid using the vulnerable widget with untrusted input where possible.