CVE-2024-30524: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in RedLettuce Plugins PDF Viewer for Elementor, affecting versions through 2.9.3. The vulnerability was identified on March 29, 2024, and was assigned CVE-2024-30524. The security issue was initially reported by security researcher Khalid Yusuf on January 6, 2024 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability specifically allows for Stored Cross-Site Scripting attacks and requires contributor-level access or higher to exploit (WPScan).

The vulnerability could allow malicious actors to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected content. This could lead to potential redirects, unauthorized advertisements, and execution of other HTML payloads on the affected website (Patchstack).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. While the attack complexity is considered low, it does require user interaction for successful exploitation (WPScan).

As of the current date, no official fix has been released for this vulnerability. The issue affects versions up to and including 2.9.3 of the PDF Viewer for Elementor plugin (Patchstack).