The Lenix Elementor Leads addon plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, a URL form field is not properly sanitized or escaped, enabling unauthenticated attackers to inject malicious scripts that persist and execute in the context of users viewing the affected pages. This vulnerability affects all versions up to and including 1.8.2. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with a scope change. There are no known exploits in the wild and no vendor-provided patch or advisory at this time.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts in the context of users accessing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session hijacking. There is no impact on availability. The vulnerability affects all users who visit the injected pages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable plugin or restricting access to affected pages to trusted users only. Implementing web application firewall (WAF) rules to detect and block malicious input may provide temporary mitigation.