The Essential Addons for Elementor plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in the 'get_manual_calendar_events' function. This vulnerability arises from improper neutralization of input during web page generation, allowing authenticated users with Contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of other users viewing the injected pages. The vulnerability affects all versions up to 5.9.22. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the Contributor level. No patch or official remediation guidance is currently available from the vendor, and no known exploits have been reported.

An attacker with Contributor-level or higher access can inject malicious JavaScript code into pages via the vulnerable function. This code executes in the browsers of users who view the compromised pages, potentially leading to session hijacking, unauthorized actions, or data theft limited to the privileges of the affected users. The vulnerability does not impact availability and requires authenticated access, reducing its severity compared to unauthenticated remote code execution. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level and higher user privileges to trusted users only. Consider disabling or removing the affected plugin if feasible. Monitor official vendor channels for updates and apply patches promptly once available.