CVE-2024-2788 is a stored cross-site scripting vulnerability in the Happy Addons for Elementor WordPress plugin affecting all versions up to 3.10.4. The flaw is due to improper neutralization of input during web page generation, specifically in the Post Title HTML Tag, where user input is not properly sanitized or escaped. Authenticated attackers with contributor-level privileges or higher can inject arbitrary scripts that execute in the context of users viewing the compromised pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. CVE-2024-32698 is likely a duplicate of this issue. No official patch or remediation details are provided in the available data.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the Post Title HTML Tag. These scripts execute in the browsers of users who visit the affected pages, potentially leading to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. There is no impact on availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider applying web application firewall (WAF) rules to detect and block suspicious input patterns related to the Post Title HTML Tag. Monitor vendor channels for updates and apply patches promptly once released.