The Essential Addons for Elementor Pro WordPress plugin contains a stored cross-site scripting vulnerability (CWE-79) in the 'eael_lightbox_open_btn_icon' parameter of its Lightbox & Modal widget. This vulnerability allows authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript code into pages, which executes when those pages are accessed by others. The root cause is insufficient sanitization and escaping of user input before rendering. The vulnerability affects all versions up to 5.8.15. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required. There is no vendor advisory or patch link currently available, and no known exploitation in the wild has been reported.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject and execute arbitrary scripts in the context of the affected website. This can lead to theft of user credentials, session hijacking, or other malicious actions performed on behalf of users viewing the injected content. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authenticated access, which reduces the attack surface compared to unauthenticated XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Lightbox & Modal widget that uses the vulnerable parameter. Monitor official Essential Addons channels for updates and apply patches promptly once available.