The Xpro Elementor Addons plugin for WordPress versions up to 1.4.4.2 contains a stored cross-site scripting (XSS) vulnerability (CWE-79) due to improper input neutralization during web page generation. This flaw allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can execute in the security context of other users, potentially leading to information disclosure, session hijacking, or other impacts. The vulnerability is tracked as CVE-2024-43150 with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No official patch or vendor advisory detailing remediation is currently available.

Successful exploitation of this stored XSS vulnerability can lead to limited confidentiality, integrity, and availability impacts, including potential information disclosure, modification of content, and disruption of service. The attack requires low privileges and user interaction, and the vulnerability affects the security context of other users due to scope change (S:C). There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting plugin usage to trusted users and monitor for suspicious activity. Avoid exposing the vulnerable plugin on publicly accessible sites if possible. No official mitigation or temporary fix has been provided by the vendor at this time.