CVE-2024-2623: 
WordPress vulnerability analysis and mitigation

The Essential Addons for Elementor WordPress plugin (CVE-2024-2623) contains a Stored Cross-Site Scripting vulnerability in versions up to and including 5.9.11. The vulnerability exists in the countdown widget's message parameter due to insufficient input sanitization and output escaping. This security issue was discovered by researcher Webbernaut and was publicly disclosed on March 25, 2024 (Wordfence).

The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability specifically affects the countdown widget's message parameter where insufficient input sanitization and output escaping allows for script injection (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor access or higher privileges to inject arbitrary web scripts into pages. These malicious scripts will execute whenever any user accesses the compromised page, potentially leading to data theft, session hijacking, or other malicious actions (WPScan).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack complexity is considered low, requiring no special conditions or user interaction for successful exploitation (Wordfence).

The vulnerability has been patched in version 5.9.12 of the Essential Addons for Elementor plugin. Users are strongly advised to update to this version or later to protect against potential attacks (WPScan).