The Element Pack Elementor Addons plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) in the Age Gate Widget's 'url' parameter. This flaw allows authenticated attackers with Contributor-level privileges or above to inject arbitrary scripts into pages. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is present in all plugin versions up to 5.10.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, user interaction, and partial impact on confidentiality and integrity but no impact on availability.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users visiting the affected pages. This can lead to partial disclosure of confidential information and modification of data within the context of the vulnerable site. There is no direct impact on system availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users only and consider disabling or restricting use of the Age Gate Widget 'url' parameter if possible.