The vulnerability identified as CVE-2024-1237 affects the Ultimate Addons for Elementor plugin, specifically the Elementor Header & Footer Builder component. It is a stored cross-site scripting (CWE-79) issue caused by improper neutralization of input during web page generation. Authenticated users with contributor or higher roles can exploit insufficient sanitization of the flyout_layout attribute to inject arbitrary JavaScript code. This code executes in the context of users visiting the affected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, with impact on confidentiality and integrity but not availability.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to unauthorized actions such as theft of sensitive information or session tokens. The impact is limited to confidentiality and integrity, with no direct availability impact. The vulnerability requires authenticated access with contributor or higher privileges, reducing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider monitoring for suspicious activity related to page content modifications. Avoid granting unnecessary privileges to users. Follow updates from brainstormforce for any released patches or official mitigations.