CVE-2024-1238 is a stored cross-site scripting vulnerability in the ElementsKit Elementor Addons plugin for WordPress, specifically affecting the button ID parameter. The flaw is due to improper neutralization of input during web page generation, allowing authenticated users with contributor or higher privileges to inject malicious scripts that execute on page load. This vulnerability affects all versions up to 3.0.6. The CVSS 3.1 base score is 6.4 (medium severity), with an attack vector of network, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no impact on availability. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

An authenticated attacker with contributor or higher privileges can inject malicious scripts via the button ID parameter, which execute in the context of users viewing the affected pages. This can lead to unauthorized actions or data disclosure limited to the confidentiality and integrity impact as per the CVSS vector. There is no indication of availability impact. The vulnerability could be used to compromise site visitors or administrators depending on the context of the injected script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the affected plugin if possible. Monitor for updates from the vendor or security advisories for a patch release.