CVE-2024-2792 is a stored cross-site scripting vulnerability (CWE-79) in the Elementor Addon Elements WordPress plugin, affecting all versions up to 1.13.2. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping on user-supplied widget attributes. This allows authenticated attackers with contributor-level access or higher to inject arbitrary scripts that execute in the context of users viewing the compromised pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated contributor or higher to inject and store malicious scripts within pages generated by the plugin. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure or session hijacking. The impact is limited to users who access the injected content and requires the attacker to have contributor-level privileges or above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.