The ElementsKit Elementor Addons WordPress plugin versions before 3.10.01 contain a stored Cross-Site Scripting (CWE-79) vulnerability. The issue arises because the plugin does not sanitize or escape specific megamenu menu-item settings before storing them and outputting them on the front end. Additionally, it does not require the unfiltered_html capability to save these settings, enabling users with administrative privileges, including non-super subsite administrators on multisite networks, to inject malicious JavaScript payloads. This vulnerability can lead to script execution in the context of network Super Admins and site visitors.

An attacker with administrative capabilities on a subsite (without unfiltered_html permission) in a multisite WordPress network can store malicious JavaScript that executes in the browsers of network Super Admins and site visitors. This could lead to session hijacking or other client-side attacks. The CVSS score is 3.5 (low severity), indicating limited impact primarily on confidentiality and integrity with no impact on availability.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict administrative access carefully, especially in multisite environments, to trusted users only. Monitor for plugin updates and apply them promptly once available.