The Elementor Website Builder plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the data-text attribute of the Text Path widget. Authenticated attackers with Contributor or higher privileges can inject malicious scripts that execute in the context of users visiting the compromised pages, but only on Chrome and Edge browsers. The vulnerability affects all versions up to and including 3.30.2. No official patch or remediation information is provided in the available data.

Successful exploitation allows authenticated users with Contributor-level access or above to inject persistent malicious scripts into pages, potentially leading to information disclosure or session hijacking for users who view the infected pages on Chrome or Edge browsers. The impact is limited to confidentiality and integrity with no reported availability impact. The vulnerability requires authentication and is browser-specific.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access and above to trusted users only. Consider disabling or avoiding use of the Text Path widget in Elementor. Monitor vendor channels for updates and apply patches promptly once released.