CVE-2024-4478: 
WordPress vulnerability analysis and mitigation

The Happy Addons for Elementor WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.10.7. The vulnerability exists in the Image Stack Group widget due to insufficient input sanitization and output escaping on the user-supplied 'tooltip_position' attribute (NVD).

The vulnerability has been assigned CVE-2024-4478 and received a CVSS v3.1 base score of 5.4 (Medium) from NVD and 6.4 (Medium) from Wordfence. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The issue specifically affects the tooltip_position attribute in the Image Stack Group widget, where insufficient input sanitization and output escaping allows for script injection (NVD, Wordfence).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attacker must have the ability to create or edit content using the Image Stack Group widget to inject malicious scripts through the tooltip_position attribute (NVD).

Users should update to a version newer than 3.10.7 of the Happy Addons for Elementor plugin to address this vulnerability. A patch has been released to fix the insufficient input sanitization and output escaping issues (WordPress).