The Mega Elements – Addons for Elementor WordPress plugin suffers from a stored XSS vulnerability (CWE-79) in its Button widget due to improper neutralization of input during web page generation. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript code into pages, which executes in the context of users viewing those pages. This vulnerability affects all versions up to 1.2.1. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts confidentiality and integrity with no impact on availability. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to unauthorized actions such as session hijacking, defacement, or other attacks that compromise user confidentiality and integrity. Availability is not impacted. The vulnerability requires authenticated access, limiting the attack surface to users with contributor or higher roles.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable Button widget if possible. Monitor for updates from kraftplugins regarding patches or official mitigations.