The vulnerability CVE-2024-34374 in QuomodoSoft ElementsReady Addons for Elementor is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. It affects versions up to 5.8.0 and allows an attacker with low privileges to inject malicious scripts that execute in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with scope changed and low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of other users, potentially allowing theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The attack requires the attacker to have low privileges and for a user to interact with the malicious content. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with user-generated content and consider applying temporary mitigations such as input sanitization or disabling vulnerable components if feasible. Monitor vendor channels for updates.