This vulnerability (CVE-2024-30232) involves CWE-79, where Exclusive Addons Elementor fails to properly sanitize input before embedding it into web pages, resulting in stored cross-site scripting. Attackers could exploit this flaw to inject malicious scripts that execute in the context of users visiting affected sites. The issue affects all versions through 2.6.9. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with scope change and low impact on confidentiality, integrity, and availability. No patch or official fix has been announced yet.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to data theft, session hijacking, or other user-targeted attacks. The impact is limited to confidentiality, integrity, and availability at a low level, but the scope change means the vulnerability can affect components beyond the initially vulnerable module. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying workarounds such as disabling or restricting the use of the affected plugin or limiting user input capabilities where feasible. Monitor official vendor channels for updates and patches.