CVE-2024-5612: 
WordPress vulnerability analysis and mitigation

The Essential Addons for Elementor Pro plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-5612) in versions up to and including 5.8.15. The vulnerability exists in the 'eael_lightbox_open_btn_icon' parameter within the Lightbox & Modal widget due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as a medium severity issue with a CVSS v3.1 base score of 5.4 (MEDIUM) according to NVD, and 6.4 (MEDIUM) according to Wordfence. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability requires network access, low attack complexity, low privileges, and user interaction. The vulnerability is categorized as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation of user sessions (NVD).

The vulnerability requires an authenticated user with at least Contributor-level privileges to exploit. The attacker needs to manipulate the 'eael_lightbox_open_btn_icon' parameter within the Lightbox & Modal widget to inject malicious scripts (NVD).

Users should upgrade to version 5.8.16 or later of the Essential Addons for Elementor Pro plugin to address this vulnerability. The fix has been implemented in the latest release to properly sanitize and escape the input in the affected parameter (Essential Addons Changelog).