CVE-2024-0977 is a stored cross-site scripting vulnerability (CWE-79) in the Timeline Widget For Elementor WordPress plugin (Elementor Timeline, Vertical & Horizontal Timeline). The issue occurs due to improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of image URLs in the timeline widget. Authenticated attackers with contributor or higher privileges can inject malicious scripts that execute when users interact with the slideshow type on affected pages. The vulnerability affects all plugin versions up to 1.5.3. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, low privileges required, and user interaction needed.

Successful exploitation allows an authenticated user with contributor-level or higher permissions to inject stored malicious scripts into pages using the timeline widget. These scripts execute in the context of users who view and interact with the affected pages, potentially leading to information disclosure or other client-side impacts. The vulnerability does not affect availability and requires user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for updates from the plugin vendor or WordPress plugin repository regarding patches or official mitigations.