CVE-2026-12231 is a stored cross-site scripting vulnerability in the Exclusive Addons for Elementor WordPress plugin. The flaw exists in the 'exad_infobox_image' parameter, which does not properly sanitize or escape user input. This allows authenticated attackers with Contributor-level privileges or above to inject arbitrary web scripts into pages. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to and including 2.7.9.8.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who view the affected pages. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity of user sessions and data.

No official patch or remediation is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the affected plugin versions to prevent exploitation.