This vulnerability in Move Addons for Elementor (<= 1.3.6) involves improper input sanitization that permits stored cross-site scripting attacks. An attacker can inject malicious scripts that are stored by the plugin and later executed in the context of users visiting the affected web pages. The CVSS vector indicates the attack requires network access, low complexity, privileges, and user interaction, with partial impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or disrupt site availability. The impact is rated medium due to the partial compromise of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as disabling or restricting the vulnerable plugin, or implementing web application firewall (WAF) rules to detect and block XSS payloads related to this plugin.