The vulnerability CVE-2024-39668 in petesheppard84 Extensions for Elementor is a stored Cross-site Scripting (CWE-79) issue caused by improper input neutralization during web page generation. This flaw allows attackers to inject malicious scripts that are stored and later executed in the browsers of users who visit the compromised pages. The affected plugin versions include all versions up to 2.0.31. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and limited impact on confidentiality, integrity, and availability. There is no vendor advisory or patch currently available, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker with low privileges to inject and store malicious scripts that execute when other users view the affected content. This can lead to limited confidentiality, integrity, and availability impacts, such as session hijacking, defacement, or other malicious actions within the context of the affected website. However, exploitation requires user interaction and low privileges, and the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting privileges for users who can submit content and apply web application firewall (WAF) rules to detect and block XSS payloads. Monitor vendor channels for updates and apply patches promptly once available.