CVE-2024-1498 is a stored cross-site scripting vulnerability (CWE-79) in the Happy Addons for Elementor plugin for WordPress, specifically affecting the Photo Stack Widget. The flaw is due to improper neutralization of input during web page generation, allowing authenticated users with contributor-level or higher permissions to inject arbitrary web scripts. These scripts execute in the context of any user viewing the compromised page. The vulnerability affects all plugin versions up to and including 3.10.3. No official patch or remediation link is provided in the available data.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to theft of user credentials, session hijacking, or other client-side attacks. The vulnerability does not allow unauthenticated attackers to exploit it and does not impact availability. The CVSS vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, and impacts confidentiality and integrity with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or avoiding use of the Photo Stack Widget. Monitor vendor channels for updates and apply patches promptly once released.