This vulnerability in Themesflat's themesflat-addons-for-elementor plugin allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions up to 2.2.0. The CVSS vector indicates the attack requires network access, low attack complexity, low privileges, and user interaction, with impacts on confidentiality, integrity, and availability. No patch or official fix information is currently provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, modification, or disruption of service. The impact is rated medium based on the CVSS score of 6.5. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider limiting exposure by restricting user input where possible and monitoring for suspicious activity related to this plugin. Avoid installing or using affected versions if possible.