CVE-2024-0506: 
WordPress vulnerability analysis and mitigation

The Elementor Website Builder plugin for WordPress (versions up to and including 3.18.3) contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-0506) via the $instance[alt] parameter in the get_image_alt function. The vulnerability was discovered and disclosed in February 2024 (Wordfence).

The vulnerability stems from insufficient input sanitization and output escaping in the get_image_alt function. The CVSS v3.1 score is 6.4 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

Successful exploitation allows authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages. These scripts will execute when users perform certain actions, such as clicking on a link (Wordfence).

The vulnerability requires authentication with at least contributor-level access to exploit. The attack complexity is considered low, but user interaction is required for successful exploitation (NVD).

The vulnerability has been patched in version 3.19.0 of the Elementor Website Builder plugin. Users are advised to update to this version or newer to mitigate the risk (Wordfence).