CVE-2024-0508 is a stored cross-site scripting vulnerability in the Orbit Fox by ThemeIsle WordPress plugin, specifically in the Pricing Table Elementor Widget. The issue is due to improper neutralization of input (CWE-79) where user-supplied link URLs are not properly sanitized or escaped before being output in web pages. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary scripts that execute in the context of users viewing the injected pages. This vulnerability affects all versions up to 2.10.27. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with contributor-level or higher permissions can inject malicious scripts into pages via the Pricing Table Elementor Widget. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to unauthorized actions or data exposure limited to the scope of the injected scripts. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the affected widget if possible. Monitor the vendor's communications for updates on patches or official mitigations.