CVE-2024-4329: 
WordPress vulnerability analysis and mitigation

The Thim Elementor Kit plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4329) affecting all versions up to and including 1.1.9. The vulnerability was discovered and disclosed on May 14, 2024, and impacts the plugin's search form functionality (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping of the 'id' parameter in the search form component. The CVSS v3.1 base score is 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity and requiring low privileges (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to data theft or session hijacking (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack vector is through the plugin's search form functionality, specifically targeting the 'id' parameter (NVD).

Users should update to version 1.1.9.1 or later of the Thim Elementor Kit plugin which contains the security fix (WordPress Plugin).