The Elementor Header & Footer Builder plugin for WordPress, included in brainstormforce's Ultimate Addons for Elementor, suffers from a stored cross-site scripting vulnerability identified as CVE-2024-11230. This vulnerability arises from improper neutralization of input (CWE-79) in the 'size' parameter, allowing authenticated users with Contributor-level or higher privileges to inject arbitrary web scripts. These scripts persist and execute in the context of any user accessing the compromised page. The vulnerability affects all plugin versions up to and including 1.6.46. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact. No patch or vendor advisory is currently available, and no known exploits have been reported.

An authenticated attacker with Contributor-level or higher access can inject persistent malicious scripts via the 'size' parameter, which execute in the browsers of users viewing the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of user data or session tokens, or unauthorized actions performed on behalf of users. There is no reported impact on availability. The vulnerability requires authenticated access, limiting exploitation scope to users with certain privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level and higher user privileges to trusted individuals only. Review and sanitize inputs related to the 'size' parameter if possible via custom code or security plugins. Monitor official brainstormforce communications for updates and apply patches promptly once available.