This vulnerability in the Themesflat themesflat-addons-for-elementor plugin allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions up to 2.3.1. The vulnerability requires network access, low attack complexity, low privileges, and user interaction. Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, exploitation requires user interaction and low privileges, limiting the ease of attack. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider limiting exposure by restricting access to the affected plugin or applying web application firewall rules that detect and block XSS payloads. Monitor vendor channels for updates and apply patches promptly once released.