This vulnerability (CVE-2024-29106) involves improper input sanitization in Leap13 Premium Addons for Elementor, leading to stored cross-site scripting (CWE-79). Attackers can inject malicious scripts that persist in the application and execute in the context of users' browsers, potentially impacting confidentiality, integrity, and availability to a limited extent. The affected product versions include all releases up to 4.10.16. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with some privileges and requiring user interaction to execute arbitrary scripts in the context of other users, potentially leading to limited disclosure or modification of data and partial disruption of service. The impact is rated medium based on the CVSS 6.5 score. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting privileges and limiting user interactions that could trigger the vulnerability where feasible.