The Royal Elementor Addons and Templates plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the `widgetGrid`, `widgetCountDown`, and `widgetInstagramFeed` methods. This vulnerability allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary web scripts due to improper input sanitization and output escaping. The injected scripts execute whenever a user accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4 (medium severity), with network attack vector, low attack complexity, and privileges required at the low level without user interaction. The vulnerability affects all plugin versions up to 1.7.1012. No patch or official fix information is currently provided.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages using vulnerable widget methods. These scripts execute in the context of any user viewing the affected pages, potentially allowing theft of session tokens, defacement, or other malicious actions limited to the scope of script execution. The vulnerability does not impact availability and requires authenticated access, limiting its exploitation scope. No known active exploitation has been reported.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable widgets if possible. Monitor for updates from the vendor or security advisories to apply patches promptly once available.