CVE-2024-0334: 
WordPress vulnerability analysis and mitigation

The vulnerability identified as CVE-2024-0334 affects the Jeg Elementor Kit plugin for WordPress in versions up to and including 2.6.4. This security flaw was discovered and reported on May 1, 2024, and is classified as a Stored Cross-Site Scripting (XSS) vulnerability that exists in the custom attribute functionality of links within several Elementor widgets (NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the Jeg Elementor Kit plugin. The severity of this vulnerability has been assessed with multiple CVSS v3.1 scores: NIST rates it at 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigns a score of 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation of user interactions (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack can be executed remotely with low attack complexity, though some versions require user interaction for successful exploitation, as indicated by the differing CVSS scores from NIST and Wordfence (NVD).

A patch has been released to address this vulnerability. Users are advised to upgrade their Jeg Elementor Kit plugin to version 2.6.5 or later to mitigate the risk (WordPress Patch).