This vulnerability, identified as CWE-79, exists in Premium Addons for Elementor versions <= 4.11.105. It allows an attacker with contributor-level privileges to inject malicious scripts due to improper input sanitization during web page generation. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability with low to partial impact.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to information disclosure, modification of content, or disruption of service. The attack requires the attacker to have contributor privileges and user interaction, limiting the scope somewhat but still posing a risk to affected installations.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit contributor privileges and monitor for suspicious activity related to this vulnerability.