CVE-2024-1326 is a stored cross-site scripting vulnerability (CWE-79) in the Jeg Elementor Kit plugin for WordPress, affecting all versions up to 2.6.2. The flaw allows authenticated users with contributor or higher privileges to inject arbitrary web scripts via HTML tag attributes due to improper input sanitization and output escaping. These scripts execute in the context of users who access the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and requiring privileges but no user interaction. No known exploits in the wild or official patches are documented in the provided data.

An attacker with contributor-level or higher permissions can inject malicious scripts that execute in the browsers of users viewing the affected pages, potentially leading to partial confidentiality and integrity loss. The vulnerability does not impact availability. Because the attack requires authenticated access, the risk is limited to users with certain privileges on the WordPress site. There are no known exploits in the wild as per the current data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting the use of the Jeg Elementor Kit plugin. Monitor for updates from the vendor or WordPress plugin repository to apply any forthcoming patches promptly.