CVE-2024-1166 is a stored cross-site scripting vulnerability in the Image Hover Effects – Elementor Addon WordPress plugin (up to version 1.4.1). The issue stems from improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes in the Image Hover Effects Widget. This allows authenticated users with contributor-level or higher permissions to inject arbitrary JavaScript code that executes in the context of other users viewing the affected pages. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.4 (Network attack vector, low attack complexity, privileges required, no user interaction, scope changed, low confidentiality and integrity impact, no availability impact).

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute when viewed by other users. This can lead to unauthorized actions performed in the context of the victim's browser, potentially compromising user data confidentiality and integrity. There is no indication of direct availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level permissions to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.