CVE-2024-5327: 
WordPress vulnerability analysis and mitigation

The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) WordPress plugin contains a DOM-Based Stored Cross-Site Scripting vulnerability (CVE-2024-5327) via the 'pp_animated_gradient_bg_color' parameter in versions up to and including 2.7.19. The vulnerability was disclosed on May 30, 2024, and received a CVSS v3.1 base score of 5.4 (Medium) from NVD (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's handling of the 'pp_animated_gradient_bg_color' parameter. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, user interaction required, and impacts to confidentiality and integrity (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least Contributor-level privileges to exploit. The attack vector is network-accessible and requires low attack complexity, though user interaction is necessary for successful exploitation (NVD).

Users should upgrade to version 2.7.20 or later of the PowerPack Addons for Elementor plugin, which contains the fix for this vulnerability (WordPress Plugin).