CVE-2024-3064: 
WordPress vulnerability analysis and mitigation

The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heading' widgets in versions up to and including 1.4.4.1. The vulnerability was discovered and disclosed on April 9, 2024, and has been assigned CVE-2024-3064. The plugin has been closed as of April 3, 2024, due to security issues (WordPress Plugin).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'Heading' widgets. The issue has been assigned a CVSS v3.1 Base Score of 6.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD Database).

A successful exploitation allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These malicious scripts will execute whenever a user accesses an injected page, potentially leading to unauthorized actions and data theft (NVD Database).

The vulnerability requires an authenticated user with contributor-level privileges or higher to exploit. The attack complexity is considered low, as it only requires the ability to input malicious content through the plugin's Heading widgets (NVD Database).

The plugin has been closed and is no longer available for download from the WordPress plugin repository as of April 3, 2024. Users are advised to remove the plugin from their WordPress installations to prevent potential exploitation (WordPress Plugin).