This vulnerability, identified as CWE-79, exists in Ultimate Addons for Elementor versions <= 1.45.2. It allows an attacker with contributor privileges to inject and execute arbitrary scripts due to improper input sanitization during web page generation. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges at the contributor level, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low to low levels. No known exploits are reported in the wild, and no official fix or patch has been disclosed.

An attacker with contributor-level access can exploit this vulnerability to execute arbitrary scripts in the context of the affected web application. This could lead to partial compromise of confidentiality, integrity, and availability of the application and its data. The impact is rated medium based on the CVSS score and the requirement for contributor privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been announced, users should monitor for updates from Brainstorm Force. Until a patch is available, limiting contributor privileges and applying strict input validation or web application firewall rules may help reduce risk.