CVE-2024-4626 is a stored cross-site scripting vulnerability in the JetWidgets For Elementor WordPress plugin affecting all versions up to 1.0.17. The issue is due to improper neutralization of input in the 'layout_type' and 'id' parameters, allowing authenticated users with contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4, reflecting medium severity with network attack vector and low complexity. No patch or official remediation guidance is currently provided.

An attacker with contributor-level or higher access can inject malicious scripts into pages via vulnerable parameters. These scripts execute in the browsers of users who view the injected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The vulnerability does not require user interaction beyond visiting the injected page and does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the JetWidgets For Elementor plugin if possible. Monitor official jetmonsters communications for updates regarding patches or mitigations.