CVE-2024-2085: 
WordPress vulnerability analysis and mitigation

The HT Mega – Absolute Addons For Elementor WordPress plugin (versions up to 2.4.6) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2085) discovered in April 2024. The vulnerability exists in the 'size' value parameter across several widgets due to insufficient input sanitization and output escaping on user-supplied attributes (NVD, WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 5.4 (Medium). The security flaw stems from improper neutralization of input during web page generation, specifically in the handling of the 'size' value in multiple widget components. The vulnerability requires authenticated access with contributor-level permissions or higher (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level or higher permissions to inject arbitrary web scripts into pages. These malicious scripts will execute whenever any user accesses the compromised page, potentially leading to unauthorized data access or manipulation of the user's browser session (Wordfence).

The vulnerability requires authentication with at least contributor-level access to exploit. The attack complexity is considered low, as it involves injecting malicious scripts through the 'size' parameter in widget configurations (NVD).

The vulnerability has been patched in version 2.4.7 of the HT Mega – Absolute Addons For Elementor plugin. Users are advised to update to this version or later to protect against potential exploitation (WPScan).