The wpWax Directorist AddonsKit for Elementor plugin versions up to 1.1.6 suffer from a stored cross-site scripting vulnerability due to improper input sanitization during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that may be executed in the context of other users, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, privileges required, user interaction, and partial impact on confidentiality, integrity, and availability.

Successful exploitation could lead to execution of arbitrary scripts in the context of affected users, potentially resulting in data disclosure, modification, or disruption of service. The impact is rated medium based on the CVSS score and the nature of stored XSS vulnerabilities. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting plugin usage or applying temporary mitigations such as input validation or disabling vulnerable features if feasible. Monitor vendor channels for updates.