The Essential Addons for Elementor WordPress plugin versions prior to 6.6.10 contain a stored cross-site scripting (CWE-79) vulnerability in the Pricing Table widget. The plugin fails to validate the HTML tag name of the widget title before rendering it, enabling users with Contributor-level or higher privileges to inject malicious JavaScript. This script executes in the context of the site when the affected page is viewed, including by administrators, potentially leading to session hijacking or other client-side impacts. No official patch or remediation level has been confirmed in the provided data.

An attacker with Contributor-level access or higher can inject persistent JavaScript code into the Pricing Table widget title. This code executes in the browser of any user viewing the affected page, including administrators, potentially allowing theft of session tokens, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access carefully and avoid using the Pricing Table widget with untrusted input. Monitor for updates from the plugin vendor and apply official patches once released.