CVE-2024-5553: 
WordPress vulnerability analysis and mitigation

The Premium Addons for Elementor WordPress plugin (versions up to 4.10.33) contains a DOM-Based Stored Cross-Site Scripting vulnerability (CVE-2024-5553). The vulnerability exists due to insufficient input sanitization and output escaping of several parameters (NVD).

The vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when users access and edit an injected element and subsequently click the element with the mouse scroll wheel. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

Successful exploitation of this vulnerability could allow attackers to inject and execute arbitrary web scripts in the context of other users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions when users interact with the compromised elements (NVD).

The vulnerability requires an authenticated user with at least Contributor-level access. The attack complexity is considered Low, requiring user interaction in the form of accessing and editing an injected element, followed by clicking it with the mouse scroll wheel (NVD).

Users should update to version 4.10.34 or later of the Premium Addons for Elementor plugin, which contains patches for this vulnerability (NVD).