This vulnerability (CVE-2024-43291) in voidCoders Void Contact Form 7 Widget For Elementor Page Builder is classified as CWE-79, indicating improper neutralization of input leading to stored Cross-site Scripting (XSS). The issue allows an attacker with high privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability to a limited extent. The vulnerability affects all versions up to 2.4.1. No vendor advisory or patch is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. However, exploitation requires high privileges and user interaction, which reduces the overall risk. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with user inputs and consider applying temporary mitigations such as input validation or disabling the vulnerable widget if feasible. Monitor vendor channels for updates regarding patches or official mitigations.