The Enter Addons plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its Countdown and Image Comparison widgets. This occurs because the plugin does not properly sanitize or escape user input attributes before rendering them in web pages. As a result, authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. This vulnerability affects all versions up to 2.2.7 and has a CVSS 3.1 base score of 6.4 (medium severity). No patch or official remediation guidance has been provided by the vendor as of the published date.

Successful exploitation allows an authenticated user with contributor or higher privileges to inject and execute arbitrary scripts in the browsers of users who visit the affected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions performed in the context of the victim's browser. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and above to trusted users only. Consider disabling or removing the vulnerable widgets (Countdown and Image Comparison) if possible. Monitor for updates from the vendor and apply patches promptly once released.