The Royal Elementor Addons plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input in the 'status' parameter handled by the wpr_update_form_action_meta AJAX action. The vulnerability is exacerbated by a leaked nonce, enabling unauthenticated attackers to access the AJAX handler and inject arbitrary web scripts. This results in script execution in the context of users visiting affected pages. The CVSS 3.1 score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction needed, and impacts on confidentiality and integrity with scope change.

An unauthenticated attacker can inject malicious scripts into pages served by the vulnerable plugin, which execute in the browsers of users who visit those pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected site. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a patch is available, consider disabling the vulnerable plugin or restricting access to the affected AJAX action if possible.