The Essential Addons for Elementor plugin for WordPress suffers from a stored XSS vulnerability due to insufficient sanitization and escaping of the alignment parameter in the Woo Product Carousel widget. Authenticated users with contributor or higher roles can exploit this to inject arbitrary web scripts that execute on page load. This vulnerability is tracked as CVE-2024-2650 and is classified under CWE-20 (Improper Input Validation). It affects all versions up to 5.9.10. The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with contributor or higher privileges can inject malicious scripts into pages via the vulnerable alignment parameter. These scripts execute in the context of users visiting the compromised pages, potentially leading to session hijacking, defacement, or other client-side attacks. The impact includes limited confidentiality and integrity loss but no availability impact. Since the attacker must be authenticated with contributor or higher access, the risk is somewhat mitigated by the need for elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only. Consider disabling or limiting use of the Woo Product Carousel widget if feasible. Monitor for updates from the plugin vendor and apply patches promptly once available.