CVE-2024-4666 is a stored cross-site scripting vulnerability in the Borderless – Addons and Templates for Elementor WordPress plugin, affecting all versions up to 1.5.3. The issue stems from improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping on user-supplied attributes in multiple widgets. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts that execute when other users access the compromised pages. This vulnerability can lead to partial confidentiality and integrity impact but does not affect availability. The CVSS 3.1 base score is 6.4 (medium severity) with attack vector network, low attack complexity, privileges required, no user interaction, and scope changed.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via vulnerable widgets. These scripts execute in the context of users viewing the pages, potentially allowing theft of sensitive information or manipulation of page content. The confidentiality and integrity of user data may be partially impacted. There is no impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — no official fix or patch information is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a patch is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the affected plugin to reduce risk.