This vulnerability in the Essential Addons for Elementor plugin allows authenticated users with contributor-level or higher permissions to perform stored cross-site scripting via the 'eael_ext_toc_title_tag' parameter. Due to improper neutralization of input during web page generation, arbitrary scripts can be injected and executed in the context of users viewing the compromised pages. The issue affects plugin versions up to 5.9.20 and is tracked as CVE-2024-4624 with a CVSS 3.1 base score of 6.4 (medium severity). No patch or official fix information is provided in the available data.

Successful exploitation allows an attacker with contributor-level permissions or above to inject persistent malicious scripts into pages, which execute in the browsers of users who access those pages. This can lead to information disclosure and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). The vulnerability does not require user interaction beyond viewing the affected page and can affect site visitors or administrators depending on page access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or limiting use of the affected parameter if possible. Monitor official wpdevteam communications and WordPress plugin repositories for updates or patches addressing this vulnerability.