The Element Pack Elementor Addons plugin for WordPress contains a stored XSS vulnerability (CWE-79) in its Lightbox widget due to improper neutralization of input during web page generation. Authenticated users with Contributor or higher privileges can inject arbitrary scripts that execute in the context of other users viewing the affected pages. This vulnerability affects all versions up to 5.10.5. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, and partial impact on confidentiality and integrity but no impact on availability. No patch or official remediation guidance is currently documented.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of other users visiting the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions limited to the scope of the injected script. The vulnerability does not impact availability and requires authenticated access, limiting its exploitation scope. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access carefully and consider disabling or limiting use of the Lightbox widget in the Element Pack Elementor Addons plugin. Monitor for vendor updates and apply patches promptly once released.