CVE-2024-10266: 
WordPress vulnerability analysis and mitigation

The Premium Addons for Elementor WordPress plugin contains a Stored Cross-Site Scripting vulnerability (CVE-2024-10266) discovered in versions up to and including 4.10.60. The vulnerability was disclosed on October 29, 2024, affecting the plugin's Video Box widget functionality (NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the Video Box widget. It has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N according to NVD's assessment, while Wordfence rated it slightly higher at 6.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

Users are advised to update their Premium Addons for Elementor plugin to a version newer than 4.10.60 to address this vulnerability. A patch has been released and is available through the WordPress plugin repository (Patch).