CVE-2024-0826: 
WordPress vulnerability analysis and mitigation

The Qi Addons For Elementor WordPress plugin versions prior to 1.6.8 contain a Stored Cross-Site Scripting (XSS) vulnerability. The issue was discovered and publicly disclosed on March 18, 2024, affecting users with contributor-level permissions or higher (WPScan).

The vulnerability stems from insufficient input validation and output escaping of shortcode attributes in the plugin. When these attributes are supplied by users, they are not properly sanitized before being output back into the page. The vulnerability has been assigned a CVSS score of 6.4 (Medium) and is classified under CWE-79, falling into the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

This vulnerability allows authenticated users with contributor-level access or higher to perform Stored Cross-Site Scripting attacks. These attacks could be leveraged against high-privilege users such as administrators, potentially leading to unauthorized actions or data exposure (WPScan).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attacker needs to manipulate specific shortcode attributes within the plugin's functionality to execute the stored XSS attack (WPScan).

The vulnerability has been patched in version 1.6.8 of the Qi Addons For Elementor plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).