CVE-2021-24273: 
WordPress vulnerability analysis and mitigation

The Clever Addons for Elementor WordPress Plugin before version 2.1.0 contains a stored Cross-Site Scripting (XSS) vulnerability that affects several widgets. The vulnerability was discovered in early 2021 and can be exploited by lower-privileged users such as contributors (WPScan).

The vulnerability exists in multiple widgets including the 'Banner' and 'Multi Banner' widgets, which accept a 'title_tag' parameter, and the 'animated headlines' widget with its 'heading_tag' parameter. Although these widgets list fixed sets of possible HTML tags, attackers can send a 'save_builder' request containing JavaScript in these parameters. The malicious JavaScript is neither filtered nor escaped, leading to execution when the saved page is viewed or previewed. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified as CWE-79 (WPScan).

When exploited, this vulnerability allows lower-privileged users to inject and execute malicious JavaScript code that will be triggered when other users view or preview the affected pages. This could lead to various attacks including session hijacking, credential theft, or other malicious actions performed in the context of the victim's browser (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack method is similar to other vulnerabilities discovered in Elementor and various Elementor addon plugins (WPScan, Wordfence).

The vulnerability has been patched in version 2.1.0 of the Clever Addons for Elementor plugin. Users are advised to update to this version or later to protect against potential attacks (WPScan).