This vulnerability (CWE-201) in Exclusive Addons Elementor allows an attacker to retrieve embedded sensitive data due to insertion of sensitive information into sent data. The affected versions are all versions up to and including 2.7.9.9. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker can retrieve sensitive information embedded in data sent by the affected plugin, potentially leading to information disclosure. The confidentiality impact is limited, with no impact on integrity or availability. This could expose sensitive data to unauthorized parties if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should monitor vendor communications for updates. Until a patch is released, consider limiting exposure of the affected plugin or restricting access to trusted users only.