CVE-2024-10323 is a stored cross-site scripting vulnerability in the JetWidgets For Elementor WordPress plugin affecting all versions up to and including 1.0.18. The issue occurs due to improper neutralization of input during web page generation, specifically via REST API SVG file uploads. Authenticated attackers with Author-level privileges or higher can upload crafted SVG files containing malicious scripts. These scripts execute in the context of users who view the SVG, potentially leading to unauthorized actions or data exposure. The vulnerability is classified under CWE-79 and has a CVSS v3.1 score of 6.4 (medium severity).

Successful exploitation allows an authenticated user with Author-level access or higher to inject and execute arbitrary web scripts in the context of other users viewing the SVG files. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of other users. Availability is not affected. There are no reports of active exploitation in the wild.

No official patch or fix is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict Author-level access and above to trusted users only to reduce risk. Avoid uploading SVG files from untrusted sources. Implement additional web application firewall (WAF) rules to detect and block malicious SVG payloads if possible.