CVE-2024-4212: 
WordPress vulnerability analysis and mitigation

The Themesflat Addons For Elementor plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4212) affecting versions up to and including 2.1.1. The vulnerability exists in multiple widgets including TF Group Image, TF Nav Menu, TF Posts, TF Woo Product Grid, TF Accordion, and TF Image Box due to insufficient input sanitization and output escaping on user-supplied attributes (NVD).

The vulnerability is classified as CWE-79 (Cross-site Scripting) with a CVSS v3.1 base score of 5.4 (Medium) according to NVD's assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Wordfence has assigned a slightly higher CVSS score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page (NVD).

The vulnerability requires an authenticated user with contributor-level privileges or higher to exploit. The attack complexity is considered low, requiring network access and no special conditions for exploitation (NVD).

Users should update to version 2.1.3 or later of the Themesflat Addons For Elementor plugin which contains fixes for this vulnerability (WordPress Plugin).