CVE-2024-34547: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Magical Addons For Elementor WordPress plugin, identified as CVE-2024-34547. The vulnerability affects versions through 1.1.34 and was disclosed on May 8, 2024. This security issue impacts the Magical Addons For Elementor plugin, which provides header, footer building, and template library functionality for WordPress websites (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has received a CVSS v3.1 base score of 5.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N according to NVD's assessment, while Patchstack assigned a slightly higher CVSS score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious scripts into the website. When exploited, these scripts can execute whenever users access the compromised pages, potentially leading to various malicious activities such as redirects, unauthorized advertisements, and other HTML payload executions (Patchstack).

The vulnerability requires an authenticated user with at least Contributor-level privileges to exploit. The attack complexity is considered low, but user interaction is required for successful exploitation (NVD).

Users are advised to update their Magical Addons For Elementor plugin to version 1.1.35 or later, which contains the fix for this vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited, but updating is still recommended as a security best practice (Patchstack).