CVE-2024-3063: 
WordPress vulnerability analysis and mitigation

The WPB Elementor Addons plugin for WordPress (versions up to and including 1.0.9) contains a Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-3063. The vulnerability was discovered due to insufficient input sanitization and output escaping on user-supplied tag attributes in the 'tags' feature of widgets (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue stems from improper neutralization of input during web page generation, classified as CWE-79. The vulnerability affects authenticated users with contributor-level access and above (NVD, Patchstack).

When exploited, this vulnerability allows authenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page. This could enable malicious actors to inject scripts for redirects, advertisements, and other potentially harmful HTML payloads that execute in visitors' browsers (NVD, Patchstack).

The vulnerability requires an authenticated user with contributor-level access or higher to exploit. The attack complexity is considered low, requiring network access and user interaction for successful exploitation (NVD).

The vulnerability has been patched in version 1.2 of the WPB Elementor Addons plugin. Users are advised to update to version 1.2 or later to remediate this security issue (Patchstack).