CVE-2024-2280 is a stored cross-site scripting vulnerability in the Better Addons for Elementor WordPress plugin by wpdive. The flaw arises from insufficient input sanitization and output escaping of user-supplied widget link URL attributes, allowing authenticated contributors and above to inject arbitrary scripts into pages. These scripts execute in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.4.1. There is no vendor advisory or patch currently provided, and no known exploits in the wild have been reported.

An attacker with contributor-level or higher privileges can inject malicious JavaScript into pages via widget link URLs. This script executes in the browsers of users who visit the infected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level permissions to trusted users only and consider implementing additional input validation or output escaping at the application level if possible. Monitor plugin updates closely and apply any security patches promptly once available.