The Style Kits for Elementor WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) in the REST API endpoint '/wp-json/agwp/v1/tokens/save'. The vulnerability arises from improper neutralization of input in the 'kit title' parameter, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and privileges required. No official patch or remediation level is currently documented.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable REST endpoint. These scripts execute in the context of users viewing the affected pages, potentially compromising user sessions or performing unauthorized actions. The impact includes limited confidentiality and integrity loss but no availability impact. Since the vulnerability requires authenticated access, the attack surface is somewhat limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level access to trusted users only. Monitor for plugin updates from analogwp and apply them promptly once available. Consider disabling or restricting access to the vulnerable REST endpoint if possible through custom rules or security plugins.