This vulnerability (CVE-2024-34547) involves improper neutralization of input in the Magical Addons For Elementor plugin by Noor alam, leading to stored Cross-site Scripting (CWE-79). The issue affects versions through 1.1.34. The CVSS 3.1 base score is 6.5, with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, requiring low privileges and user interaction, with scope change and low impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor or in the advisory data.

Successful exploitation could allow an attacker with low privileges and requiring user interaction to execute stored malicious scripts in the context of affected users, potentially leading to partial confidentiality, integrity, and availability impacts. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable component. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting plugin usage or applying temporary mitigations such as input validation or disabling vulnerable features if feasible. Monitor vendor channels for updates.