CVE-2024-10788 is a stored cross-site scripting vulnerability in the Elementor Activity Log – Monitor & Record User Changes WordPress plugin. The flaw arises from insufficient sanitization and escaping of event parameters, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of administrative users when they access pages containing the injected payload. The vulnerability affects all versions up to and including 2.11.1. The CVSS 3.1 base score is 7.2 (High), with attack vector network, low attack complexity, no privileges required, no user interaction, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of an administrative user, potentially resulting in unauthorized actions, data theft, or session hijacking. The vulnerability impacts confidentiality and integrity but does not affect availability. Since the attacker does not require authentication or user interaction, the risk is significant for sites using this plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for updates from the vendor or security advisories is recommended to apply any forthcoming patches promptly.