This vulnerability in EnvoThemes Envo's Elementor Templates & Widgets for WooCommerce (<= 1.4.19) involves improper input neutralization leading to stored cross-site scripting (XSS). An attacker can inject malicious scripts that are stored and later executed in the browsers of users who visit the affected pages. The CVSS vector indicates the attack requires network access, low attack complexity, privileges, and user interaction, with impacts on confidentiality, integrity, and availability. No patch or official remediation details are currently provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The medium severity reflects these risks but also the requirement for user interaction and some privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting privileges for users who can input data that is rendered by the plugin and apply web application firewall (WAF) rules to detect and block XSS payloads related to this plugin. Monitor official EnvoThemes communications for updates.