The X Addons for Elementor WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) in the Youtube Video ID parameter due to inadequate input sanitization and output escaping. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute when users access affected pages. This vulnerability affects all versions up to 1.0.16 and has a CVSS 3.1 base score of 6.4 (medium severity). No patch or remediation details are currently provided by the vendor. The vulnerability could allow attackers to perform actions such as session hijacking or defacement via script injection, but exploitation requires authenticated access.

An attacker with contributor-level or higher access can inject malicious scripts into pages via the Youtube Video ID field. These scripts execute in the context of users visiting the affected pages, potentially leading to information disclosure or user session compromise. The vulnerability does not affect availability and requires authentication, limiting its impact to confidentiality and integrity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only. Review and sanitize inputs manually if possible, and consider removing or disabling the vulnerable Youtube Video ID feature. Monitor official pencilwp communications for updates and apply any released patches promptly.