CVE-2024-3718: 
WordPress vulnerability analysis and mitigation

The Plus Addons for Elementor plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-3718) affecting all versions up to and including 5.5.4. The vulnerability exists due to insufficient input sanitization and output escaping on user supplied attributes in several of the plugin's widgets (NVD).

The vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The CVSS v3.1 base score is 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N according to NVD assessment (NVD).

When exploited, this vulnerability allows attackers to inject malicious scripts that execute in users' browsers when they visit affected pages. This could lead to theft of sensitive information, session hijacking, or other client-side attacks against site visitors (NVD).

The vulnerability requires an authenticated user with contributor-level privileges or higher to exploit. The attack complexity is low, requiring user interaction (visiting the affected page) for the exploit to be triggered (NVD).

Users should update to version 5.5.5 or later which contains fixes for this vulnerability. A patch has been released and is available through the WordPress plugin repository (WordPress Patch).