CVE-2024-44032: 
WordPress vulnerability analysis and mitigation

CVE-2024-44032 is a Cross-site Scripting (XSS) vulnerability discovered in the NicheAddons Restaurant & Cafe Addon for Elementor WordPress plugin affecting versions through 1.5.5. The vulnerability was reported on August 30, 2024, by João Pedro S Alcântara and published on September 24, 2024 (Patchstack).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, stemming from improper neutralization of input during web page generation. It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation) (Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website, which would be executed when visitors access the site (Patchstack).

The vulnerability requires contributor-level privileges to exploit, and has been classified as having a low priority for patching due to its limited impact and exploitation difficulty (Patchstack).

The vulnerability has been fixed in version 1.5.6 of the Restaurant & Cafe Addon for Elementor plugin. Users are advised to update to version 1.5.6 or later to remove the vulnerability (Patchstack).