CVE-2024-2327: 
WordPress vulnerability analysis and mitigation

The Global Elementor Buttons plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.1.0. The vulnerability was discovered in early 2024 and the plugin was subsequently closed on April 3, 2024 due to security issues (MITRE CVE).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes, specifically in the button link URL functionality. This security flaw allows authenticated users with contributor-level permissions or higher to inject malicious web scripts into pages (MITRE CVE).

When successfully exploited, the vulnerability allows injected malicious scripts to execute whenever a user accesses an affected page. This can potentially lead to unauthorized actions being performed in the context of the visiting user's browser session (MITRE CVE).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. This means that potential attackers need to have a valid account on the WordPress site with sufficient privileges to access the plugin's functionality (MITRE CVE).

Due to the security concerns, the plugin has been closed and is no longer available for download from the WordPress plugin repository as of April 3, 2024. Users are advised to remove this plugin from their WordPress installations and seek alternative solutions (WordPress Plugin).