CVE-2024-1392: 
WordPress vulnerability analysis and mitigation

CVE-2024-1392 affects the Elementor Addon Elements plugin for WordPress, discovered in versions up to and including 1.12.12. The vulnerability is a Stored Cross-Site Scripting (XSS) issue found in the 'button1_icon' attribute of the Dual Button widget. This security flaw was identified and disclosed on March 13, 2024, with a fix released in version 1.13 (NVD, WPScan).

The vulnerability stems from insufficient input sanitization and output escaping in the Dual Button widget's 'button1_icon' attribute. The CVSS v3.1 base score is 5.4 (Medium) according to NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Wordfence assessed it with a slightly higher CVSS score of 6.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever any user accesses the compromised page, potentially leading to data theft, session hijacking, or other client-side attacks (NVD, WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring no special conditions or circumstances for exploitation (NVD).

Users are advised to update their Elementor Addon Elements plugin to version 1.13 or later, which contains the security fix for this vulnerability (WPScan).