The Plus Addons for Elementor plugin for WordPress contains a stored XSS vulnerability (CWE-79) in the video_date attribute of its Video widget. This flaw allows authenticated attackers with contributor-level privileges or above to inject arbitrary JavaScript code that is stored and executed in the context of users viewing the compromised pages. The vulnerability affects all versions up to and including 5.6.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

Successful exploitation enables an attacker with contributor-level access to execute arbitrary scripts in the browsers of users who visit the injected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected website. There is no indication of impact on availability. The vulnerability requires authenticated access, limiting exposure to users with at least contributor privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Video widget in The Plus Addons for Elementor plugin. Monitor for updates from the vendor and apply patches promptly once available.