The HT Mega Addons for Elementor plugin (up to version 2.5.5) contains a stored cross-site scripting vulnerability (CWE-79) in its Video player widget settings. This flaw allows authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts due to improper neutralization of input during web page generation. The injected scripts execute whenever a user accesses the compromised page, potentially leading to unauthorized actions or data exposure within the context of the affected site. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the Video player widget settings. These scripts execute in the context of users visiting the affected pages, potentially leading to unauthorized actions such as session hijacking or data theft limited to the privileges of the compromised site users. The vulnerability does not impact availability and requires authenticated access, reducing its overall impact severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit contributor-level access to trusted users only and consider disabling or restricting use of the Video player widget settings in the HT Mega Addons plugin. Monitor for updates from the vendor and apply patches promptly once released.