CVE-2024-3489 is a reflected cross-site scripting vulnerability (CWE-79) in the Exclusive Addons for Elementor WordPress plugin. The issue occurs due to improper neutralization of input in the Countdown Expired Title parameter, allowing injection of arbitrary web scripts. This affects all plugin versions up to and including 2.6.9.4. The vulnerability can be exploited remotely by unauthenticated attackers who can convince users to click on malicious links, leading to script execution in the context of the affected site. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to partial disclosure of confidential information and modification of data. There is no direct impact on availability. The vulnerability requires the attacker to trick a user into clicking a malicious link, and the attacker must have low privileges on the site. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted links and consider disabling or limiting use of the Countdown Expired Title feature if feasible. Monitor official vendor channels for updates regarding patches or mitigations.