CVE-2024-3064 is a stored cross-site scripting vulnerability in the Stax Addons for Elementor WordPress plugin, specifically affecting the 'Heading' widgets. The issue is caused by improper neutralization of input during web page generation, allowing authenticated users with contributor-level privileges or above to inject arbitrary JavaScript code. This code executes in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to and including 1.4.4.1. No patch or official fix has been documented in the provided data.

An attacker with contributor-level access or higher can inject malicious scripts that execute in the browsers of users who view the affected pages. This can lead to unauthorized actions performed on behalf of users, theft of session tokens, or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface. The CVSS score of 6.4 reflects a medium severity impact with low complexity and no user interaction required beyond viewing the injected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the affected 'Heading' widgets in the Stax Addons for Elementor plugin. Monitor for updates from the vendor or WordPress plugin repository regarding patches or mitigations.