The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the Pricing Widget's 'onClick Event' setting. This vulnerability arises from improper neutralization of input during web page generation, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. The injected scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 1.4.20. No vendor-provided patch or official remediation level is currently documented. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at low level, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with contributor-level access or higher can inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to unauthorized actions such as theft of session tokens or other sensitive information accessible via the browser context. The vulnerability does not impact system availability. There are no known exploits in the wild, and the impact is limited to confidentiality and integrity of user sessions or data accessible through the browser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable Pricing Widget if feasible. Monitor official vendor channels for updates regarding patches or mitigations.