CVE-2024-34570 is a stored cross-site scripting vulnerability in Xpro Elementor Addons (up to version 1.4.3) caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that are stored and later executed in the browsers of users who view the compromised content. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity with network attack vector, low attack complexity, requiring high privileges and user interaction, and resulting in low impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to limited confidentiality, integrity, and availability impacts such as session hijacking or content manipulation. However, exploitation requires user interaction and high privileges, which reduces the overall risk. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit high-privilege access to the Xpro Elementor Addons plugin and exercise caution with user-generated content. Monitor vendor channels for updates and apply patches promptly once released.