The Element Pack Elementor Addons plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in its Custom Gallery and Countdown widgets due to improper neutralization of user-supplied input. This allows authenticated users with contributor-level privileges or above to inject arbitrary web scripts into pages. These scripts execute in the context of any user who views the compromised page, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to 5.7.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with contributor-level access or higher can exploit this vulnerability to inject and store malicious scripts in pages using the vulnerable widgets. These scripts execute in the browsers of users who visit the affected pages, potentially leading to unauthorized actions such as data theft or session hijacking. The impact is limited to confidentiality and integrity, with no direct impact on availability. The vulnerability requires authenticated access, reducing the attack surface compared to unauthenticated vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the Custom Gallery and Countdown widgets in the affected plugin versions. Monitor vendor channels for updates and apply patches promptly once released.