CVE-2024-2350: 
WordPress vulnerability analysis and mitigation

The Clever Addons for Elementor plugin for WordPress (CVE-2024-2350) contains a Stored Cross-Site Scripting vulnerability affecting versions up to and including 2.1.9. The vulnerability exists in multiple widgets including CAFE Icon, CAFE Team Member, and CAFE Slider due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as CWE-79 (Cross-site Scripting) with a CVSS v3.1 base score of 5.4 (Medium) according to NVD, and 6.4 (Medium) according to Wordfence. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R) in the NVD scoring (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attacker needs to have access to the WordPress admin panel to inject malicious scripts through the affected widgets (NVD).

The vulnerability has been patched in the plugin's source code, as evidenced by the updates to multiple files including class-clever-icon.php, class-clever-slider.php, and class-clever-team-member.php (Patch, Patch, Patch).