The Premium Addons for Elementor plugin for WordPress suffers from a DOM-based stored XSS vulnerability (CWE-79) due to insufficient input sanitization and output escaping in multiple parameters. Authenticated attackers with Contributor-level privileges or above can inject arbitrary JavaScript code into pages. This malicious code executes when a user interacts with the injected element by editing it and clicking it with the mouse scroll wheel. The vulnerability affects all versions up to and including 4.10.33. The CVSS 3.1 base score is 4.4 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, and user interaction needed, with limited confidentiality and integrity impact and no availability impact. There is no vendor advisory or patch information currently provided.

Successful exploitation allows authenticated users with Contributor-level access or higher to inject and execute arbitrary scripts in the context of the affected site. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. The attack requires user interaction and specific mouse actions, limiting its ease of exploitation. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access and above to trusted users only. Monitor for plugin updates from leap13 and apply them promptly once available. Avoid interacting with suspicious or untrusted content within the plugin's editable elements.