The Easy Elementor Addons – Addons Pack for Elementor Page Builder plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in versions less than or equal to 2.2.9. This vulnerability allows authenticated users with contributor or higher privileges to inject arbitrary web scripts through multiple widget parameters due to improper input neutralization during web page generation. The injected scripts execute in the context of users who visit the compromised pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity without availability impact.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages, which execute when viewed by other users. This can lead to partial confidentiality and integrity impacts, such as theft of user credentials or unauthorized actions performed in the context of affected users. There is no impact on availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the vulnerable plugin. Monitor for updates from the vendor and apply patches promptly once released.