This vulnerability (CVE-2024-38718) in the Download Button for Elementor plugin by clicklabs® Medienagentur is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), resulting in stored cross-site scripting (XSS). It affects all versions up to 1.2.1. The flaw allows an attacker with low privileges to inject malicious scripts that are stored and executed in the context of users viewing the affected web pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official fix has been published as of the data provided.

Exploitation of this stored XSS vulnerability could allow attackers to execute arbitrary scripts in the context of users visiting the affected site, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The attack requires user interaction and low privileges, which somewhat limits the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version or applying any recommended temporary mitigations from the vendor. Monitor vendor channels for updates and apply patches promptly once released.