CVE-2024-0438 is a stored cross-site scripting vulnerability in the Happy Addons for Elementor WordPress plugin, specifically in the Age Gate feature's wrapper link parameter. Authenticated users with contributor or higher privileges can inject arbitrary web scripts due to improper input sanitization and output escaping. These scripts execute when any user accesses the injected page, potentially compromising user interactions. The vulnerability affects all versions up to 3.10.1. No official patch or remediation details are provided in the available data. CVSS v3.1 rates this vulnerability as medium severity with a score of 6.4.

An attacker with contributor or higher privileges can exploit this vulnerability to inject malicious scripts that execute in the context of other users visiting the affected pages. This can lead to unauthorized actions performed on behalf of users or theft of sensitive information accessible to the browser session. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Age Gate feature if feasible. Monitor for updates from the vendor and apply patches promptly once released.