The Plus Addons for Elementor plugin is vulnerable to stored cross‑site scripting through the menu_hover_click parameter of the Navigation Menu Lite widget in versions up to and including 6.4.11. The lack of input sanitization and output escaping allows an attacker with contributor-level access or higher to inject arbitrary scripts that execute whenever a page containing the widget is viewed. This can lead to credential theft, session hijacking or defacement. The weakness is identified as CWE‑79.

Vendor posimyththemes provides the plugin The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce. All releases up to 6.4.11 are affected, including 6.4.11 itself.

The CVSS score of 6.4 indicates a medium‑severity risk. EPSS data is not available, so the exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires authenticated access with contributor-level permissions, so the threat surface is limited to users who can modify plugin widgets. If such an access level exists, an attacker can inject scripts that run for every visitor to the affected page.