The SKT Addons for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its Age Gate and Creative Slider widgets. The issue arises from improper neutralization of input during web page generation, allowing authenticated attackers with contributor-level privileges or above to inject arbitrary JavaScript code. This code executes in the context of any user who accesses the compromised page, potentially leading to data theft, session hijacking, or other malicious actions. The vulnerability affects all plugin versions up to 2.0. No patch or official fix information is provided in the available data.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:L/I:L/A:L). There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the vulnerable widgets (Age Gate and Creative Slider). Monitor for plugin updates from the vendor and apply them promptly once released.