CVE-2024-2349 is a stored cross-site scripting vulnerability in the Fancy Elementor Flipbox WordPress plugin (hosseinhashemi) affecting all versions up to 2.5.1. The vulnerability is due to improper neutralization of input during web page generation (CWE-79), allowing authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts via the Flipbox widget. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, requiring privileges, no user interaction, scope changed, with low confidentiality and integrity impact and no availability impact. No patch or vendor advisory is provided, and no known exploits are reported in the wild.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable Flipbox widget. These scripts execute in the browsers of users who view the affected pages, potentially leading to theft of user credentials, session tokens, or other sensitive information. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope is changed, meaning the vulnerability can affect resources beyond the attacker’s privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Fancy Elementor Flipbox plugin if possible. Monitor for updates from the plugin vendor or WordPress security channels for an official patch or mitigation.