CVE-2024-13699 is a stored XSS vulnerability in the Qi Addons For Elementor WordPress plugin caused by insufficient input sanitization and output escaping of the 'cursor' parameter. Authenticated attackers with Contributor-level privileges or higher can exploit this to inject arbitrary web scripts into pages, which execute upon page access by other users. Partial fixes were introduced in versions 1.8.5, 1.8.6, and 1.8.7, but these versions are still vulnerable. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows authenticated users with Contributor or higher privileges to inject and execute arbitrary scripts in the context of the affected website. This can lead to data theft, session hijacking, or other malicious actions impacting confidentiality and integrity. Availability is not affected. No known exploits in the wild have been reported.

No official patch or fix is confirmed as available. Partial patches in versions 1.8.5 to 1.8.7 do not fully resolve the issue. Users should monitor the vendor's advisory for updates and apply any forthcoming official fixes promptly. Until a full fix is released, restrict Contributor-level access and above to trusted users only to reduce risk.