CVE-2024-2924 is a stored cross-site scripting vulnerability in the Creative Addons for Elementor WordPress plugin, affecting all versions up to and including 1.5.12. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping on user-supplied attributes in the plugin's widgets. This allows authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact.

An attacker with contributor-level or higher privileges can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to partial compromise of confidentiality and integrity of user data within the context of the affected site. There is no direct impact on availability. The vulnerability affects all versions up to 1.5.12 of the plugin. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit contributor-level access to trusted users only. Consider removing or disabling the affected plugin widgets if possible. Monitor official echoplugins communications for updates regarding patches or mitigations.