Premium Addons for Elementor < 4.11.85 - Contributor+ Stored Cross-Site Scripting via premium_tooltip_text Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'premium_tooltip_text' parameter due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts. The injected payload is triggered when an administrator or higher-privileged user opens the affected post in the Elementor editor, as the raw unescaped output occurs via the print_template() method registered on the 'elementor/section/print_template' hook rather than on the public-facing frontend.