ElementInvader Addons for Elementor versions up to 1.3.0 contain a DOM-based cross-site scripting vulnerability caused by improper neutralization of input during web page generation. This allows an attacker with limited privileges and requiring user interaction to potentially execute malicious scripts in the context of the affected web application. The CVSS score is 6.5 (medium), indicating moderate impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system. The attack requires user interaction and privileges, limiting the ease of exploitation. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with this plugin and consider disabling or restricting its use in sensitive environments.