The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin contains a stored cross‑site scripting flaw in the Calendar and Business Reviews widgets. Because input from these widgets is not properly sanitized or escaped, an authenticated user with at least Contributor role can insert malicious JavaScript. When a page displaying these widgets is viewed, the injected code runs in the context of the site, potentially allowing cookie theft, session hijacking, or defacement. The vulnerability does not grant arbitrary code execution on the server side, but it compromises the confidentiality and integrity of all site visitors who view the affected content.

The flaw affects all installations of the Essential Addons plugin up to and including version 6.1.19. Any WordPress site running this plugin with the Calendar or Business Reviews widgets exposed to Contributor or higher roles is vulnerable. The plugin is distributed by wpdevteam and listed in the WordPress plugin repository.

The CVSS v3 base score of 6.4 classifies the issue as medium severity, while the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack requires the attacker to be authenticated and possess Contributor or higher privileges, and the malicious payload is executed only when a visitor loads a page containing the compromised widget. Because the vulnerability relies on authenticated access and client‑side execution, the overall risk is moderate but still significant for sites that expose these widgets to higher‑privileged users.