CVE-2024-2252 is a stored cross-site scripting vulnerability in the Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder WordPress plugin. The flaw exists due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes like URLs in plugin widgets. Authenticated attackers with contributor or higher privileges can inject malicious scripts that execute in the context of users visiting the compromised pages. This vulnerability affects all plugin versions up to and including 3.1.5.

Successful exploitation allows authenticated users with contributor-level or higher permissions to inject arbitrary web scripts into pages. These scripts execute in the browsers of users who access the injected pages, potentially leading to information disclosure or other client-side impacts. The vulnerability does not affect availability and requires authentication with limited privileges, resulting in a medium severity rating (CVSS 5.4). There are no known exploits in the wild at this time.

No official patch or fix information is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level permissions carefully and monitor for suspicious activity related to the plugin. Avoid granting contributor or higher privileges to untrusted users. Review and sanitize user inputs manually if possible.