This vulnerability (CVE-2024-32592) involves improper neutralization of input during web page generation in the Void Elementor WHMCS Elements For Elementor Page Builder plugin. It allows stored cross-site scripting (CWE-79), where malicious scripts can be injected and persist in the application, potentially impacting confidentiality, integrity, and availability. The vulnerability requires network access, low attack complexity, low privileges, and user interaction, with a scope change. It affects versions through 2.0. No patch or official remediation level has been disclosed by the vendor or in the advisory.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to data disclosure, modification, or disruption of service. The CVSS vector indicates partial impact on confidentiality, integrity, and availability. However, exploitation requires user interaction and low privileges, limiting the attacker's capabilities somewhat.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin and monitor for suspicious activity. Avoid exposing the plugin to untrusted users where possible. No official or temporary fix has been published at this time.