The PowerPack Elementor Addons plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) in its Custom Cursor Extension. Authenticated attackers with Contributor-level permissions can inject arbitrary web scripts due to improper neutralization of input during page generation. These scripts execute in the context of users who access the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to 2.9.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity but no impact on availability.

An attacker with Contributor-level access can inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed on behalf of users. There is no impact on system availability. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling the Custom Cursor Extension if feasible. Monitor for updates from ideaboxcreations regarding a security patch or official mitigation steps.