This vulnerability (CVE-2024-35713) in the Testimonial Carousel For Elementor plugin is due to improper input sanitization leading to stored cross-site scripting (CWE-79). An attacker can inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. The issue affects all versions up to 10.1.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No vendor advisory or patch is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users visiting the affected site, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The impact is rated medium severity with a CVSS score of 6.5. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor for vendor updates and apply patches promptly once available.