CVE-2024-3162 is a stored cross-site scripting vulnerability in the Jeg Elementor Kit plugin for WordPress, specifically in the Testimonial Widget Attributes. The vulnerability arises from improper neutralization of alternate XSS syntax (CWE-87), allowing authenticated users with contributor or higher privileges to inject malicious scripts that execute in the context of other users viewing the affected pages. This affects all versions up to and including 2.6.3. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No patch or remediation information is currently provided.

An authenticated attacker with contributor or higher privileges can inject stored malicious scripts via the Testimonial Widget Attributes, which execute when other users access the injected pages. This can lead to partial compromise of confidentiality and integrity of user data within the affected WordPress site. There is no indication of impact on availability. The vulnerability requires authentication and privileges, limiting the attack surface to users with contributor or higher roles.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor and higher privileges to trusted users only and consider disabling or limiting use of the Testimonial Widget Attributes in the Jeg Elementor Kit plugin. Monitor vendor channels for updates and apply patches promptly once released.