CVE-2024-3309: 
WordPress vulnerability analysis and mitigation

The Qi Addons For Elementor plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-3309) in versions up to and including 1.7.0. The vulnerability exists in the Countdown Widget's attributes due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has received a CVSS v3.1 base score of 5.4 (MEDIUM) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigned a score of 6.4 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor access or higher privileges to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated attacker with at least contributor-level access to exploit. The attack can be performed remotely over the network, requires low attack complexity, and needs user interaction for successful exploitation (NVD).

Users should update the Qi Addons For Elementor plugin to a version newer than 1.7.0 which contains the security fix (NVD).