CVE-2024-4695: 
WordPress vulnerability analysis and mitigation

CVE-2024-4695 affects the Move Addons for Elementor plugin for WordPress in versions up to and including 1.3.1. The vulnerability was discovered and reported by Wordfence, with the initial disclosure made on May 21, 2024. This security issue impacts multiple widgets within the plugin and affects WordPress installations using the vulnerable versions (NVD).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue (CWE-79) that exists due to insufficient input sanitization and output escaping on user-supplied attributes across multiple widgets. The severity is rated as MEDIUM with a CVSS v3.1 base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) according to NVD, while Wordfence rates it at 6.4 (Wordfence).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to client-side attacks against site visitors (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) (NVD).

A patch has been released to address this vulnerability. Users should update their Move Addons for Elementor plugin to a version newer than 1.3.1 to mitigate this security risk (WordPress).