The Essential Addons for Elementor plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This occurs in multiple vectors within the Event Calendar widget and Image Masking module, where user-supplied input is not properly sanitized or escaped. Authenticated users with Contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of other users viewing the compromised pages. The vulnerability affects all versions up to 6.5.3 and has a CVSS 3.1 base score of 6.4 (medium severity). No patch or official fix has been documented in the provided data, and no known exploitation has been reported.

Successful exploitation allows an authenticated user with Contributor-level access or above to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability but can compromise confidentiality and integrity of user sessions or data within the affected WordPress site.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Monitor for suspicious activity related to the Event Calendar widget and Image Masking module. Avoid using affected plugin versions if possible. Do not rely on generic mitigations; await vendor-provided patches or official guidance.