CVE-2024-7247: 
WordPress vulnerability analysis and mitigation

The Element Pack Elementor Addons plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-7247) in versions up to and including 5.7.2. The vulnerability affects the plugin's Custom Gallery and Countdown widgets due to insufficient input sanitization and output escaping on user-supplied attributes (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 5.4 (Medium) according to NIST, and 6.4 (Medium) according to Wordfence. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L). The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when users access the affected pages (NVD).

When exploited, this vulnerability allows authenticated attackers to inject malicious web scripts into pages that will execute whenever any user accesses the compromised page. This could lead to potential theft of sensitive information, session hijacking, or other malicious actions performed in the context of the visiting user's browser (NVD).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack complexity is considered low, making it relatively straightforward to exploit for attackers who meet the authentication requirement (NVD).

Users should update to version 5.7.3 or later of the Element Pack Elementor Addons plugin to address this vulnerability. The fix includes improved input sanitization and output escaping for user-supplied attributes in the affected widgets (WordPress Plugin).