The Stratum – Elementor Widgets plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in the Countdown widget's 'label_years' attribute. This flaw allows authenticated users with Contributor-level permissions or above to inject arbitrary JavaScript code into pages. The vulnerability is due to inadequate sanitization and escaping of user-supplied input before rendering it in the web page. When other users access the compromised page, the injected scripts execute in their browsers, potentially leading to session hijacking or other client-side attacks. The issue affects all plugin versions up to and including 1.4.1. No patch or official remediation has been documented yet.

An attacker with Contributor-level or higher access can store malicious scripts in the 'label_years' attribute of the Countdown widget, which execute in the context of users viewing the affected pages. This can lead to the theft of user credentials, session tokens, or other sensitive information accessible through the browser. The vulnerability does not affect availability but impacts confidentiality and integrity of user data. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider removing or disabling the Countdown widget if feasible. Monitor for plugin updates from jetmonsters and apply them promptly once available.