This vulnerability (CVE-2026-66688) is a CWE-79 cross-site scripting issue in the Ultimate Addons for Elementor plugin by Brainstorm Force. It affects versions up to and including 1.45.2. The vulnerability arises from improper neutralization of input during web page generation, enabling a contributor-level user to execute arbitrary scripts in the context of the affected site. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation has been disclosed yet.

Successful exploitation could allow an attacker with contributor-level privileges to execute arbitrary scripts in the context of the affected website, potentially leading to partial compromise of confidentiality, integrity, and availability of the site. However, exploitation requires authenticated contributor access and user interaction, limiting the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit contributor-level access to trusted users only and monitor for suspicious activity related to script injection.