This vulnerability, classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), exists in the Exclusive Addons Elementor plugin by Tim Strifler. It allows sensitive information to be inserted into data sent by the plugin, which can then be retrieved by an attacker. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. The affected versions include all versions up to 2.7.9.9. There is no vendor advisory or patch available at this time.

An attacker can retrieve sensitive information embedded in data sent by the vulnerable plugin, potentially leading to information disclosure. The confidentiality impact is limited, with no impact on integrity or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor official channels for updates and consider limiting exposure of the affected plugin where possible.