The Premium Addons PRO plugin for Elementor is vulnerable to stored XSS via the Custom Mouse Cursor module due to improper neutralization of input during web page generation. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the compromised pages. This vulnerability is tracked as CVE-2024-2238 and has a CVSS 3.1 base score of 6.4 (medium severity). No official patch or remediation guidance has been provided yet, and no known exploits have been reported.

Successful exploitation allows authenticated users with contributor-level access or higher to inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or defacement, but does not affect availability. The vulnerability requires authentication and privileges beyond a basic user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Custom Mouse Cursor module to reduce risk.