A critical Stored Cross-Site Scripting vulnerability in the Free Theme Builder for Elementor plugin allows unauthenticated attackers to compromise administrator accounts.

This vulnerability involves improper input sanitization of contact form fields. An unauthenticated attacker can inject malicious scripts that execute within the browser of an administrator viewing the form submissions.

Successful exploitation poses a severe risk to organizational security, as the execution of scripts in an administrator's session can lead to full account takeover or unauthorized administrative actions. With a CVSS score of 8.8, this flaw is categorized as high severity due to the potential for complete compromise of the WordPress management interface and sensitive data stored therein.

Immediate Action: Update the Free Theme Builder for Elementor plugin to version 1.6.7 or later immediately.

Proactive Monitoring: Review administrative audit logs for suspicious activity or unauthorized changes to site configuration and user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads in form submissions.

Public Exploit Available: No (there is no confirmed public exploit in the available data).

Given the high CVSS score and the potential for privilege escalation via administrative account compromise, this update should be prioritized. Administrators must verify that all instances of the plugin are upgraded to version 1.6.7 to eliminate the XSS vector.