CVE-2024-33631: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in Piotnet Addons For Elementor Pro plugin versions through 7.1.17. The vulnerability was discovered by Dave Jong from Patchstack and was assigned CVE-2024-33631. The issue was initially reported on November 22, 2023, and was publicly disclosed on April 25, 2024 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) issue. It has received a CVSS v3.1 base score of 6.5 (Medium) from Patchstack and 9.8 (Critical) from CISA-ADP. The vulnerability requires contributor-level privileges to exploit, falling under the OWASP Top 10 category A3: Injection (Patchstack).

If exploited, this vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability requires authentication at the Contributor level or higher to exploit. Patchstack has classified this as having a low priority for patching, suggesting that while the vulnerability exists, it is unlikely to be exploited (Patchstack).

Currently, there is no official fix available for this vulnerability. The issue affects versions up to and including 7.1.17 of the Piotnet Addons For Elementor Pro plugin (Patchstack).