This vulnerability (CVE-2024-38705) in ElementInvader Addons for Elementor is a stored Cross-site Scripting (CWE-79) issue caused by improper input neutralization during web page generation. It affects versions up to 1.2.4 and allows an attacker with low privileges and requiring user interaction to execute scripts in the context of the affected web application. The CVSS 3.1 base score is 6.5, indicating medium severity with impacts on confidentiality, integrity, and availability. No vendor patch or official remediation level has been disclosed, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing the affected web pages, potentially leading to data disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The attack requires user interaction and limited privileges, which somewhat reduces the risk. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting user input capabilities and applying web application firewall (WAF) rules to detect and block suspicious script injections related to this vulnerability. Monitor vendor channels for updates and apply patches promptly once available.