CVE-2024-2335 is a stored cross-site scripting vulnerability in the Elements Plus! WordPress plugin by cssigniterteam. The issue arises from insufficient sanitization and escaping of user-supplied attributes in widget link URLs, allowing authenticated contributors or higher to inject arbitrary scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 2.16.2. There is no indication of known exploits in the wild or an official patch at this time.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via widget link URLs. This can lead to unauthorized actions performed in the context of other users viewing the affected pages, such as theft of session tokens or manipulation of page content. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent, as reflected by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or limiting the use of the vulnerable plugin. Monitor for updates from the vendor cssigniterteam regarding patches or official mitigations.