This vulnerability, identified as CVE-2024-35688, is a CWE-79 type stored cross-site scripting (XSS) issue in the Master Addons for Elementor plugin by Jewel Theme. It affects versions up to 2.0.5.9 and allows improper neutralization of input during web page generation. The vulnerability requires low privileges and user interaction but can lead to a complete security context compromise (scope changed). The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, scope changed, and low impact on confidentiality, integrity, and availability.

An attacker with low privileges who can trick a user into interacting with malicious content may execute stored XSS attacks, potentially leading to partial compromise of confidentiality, integrity, and availability within the affected scope. This could allow execution of arbitrary scripts in the context of the affected web application, impacting users who interact with the malicious payload.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider limiting exposure by restricting plugin usage to trusted users and monitoring for suspicious activity related to stored XSS. Avoid enabling untrusted input in contexts rendered by the plugin.