The vulnerability CVE-2024-49259 affects the Primary Addon for Elementor plugin by nicheaddons, allowing stored cross-site scripting due to improper input neutralization during web page generation. This can enable an attacker with low privileges to inject malicious scripts that execute in the context of other users, potentially leading to information disclosure, integrity, and availability impacts. The issue affects all versions up to 1.5.8. No patch or official remediation guidance is currently available.

Successful exploitation of this stored XSS vulnerability could allow attackers to execute arbitrary scripts in the context of affected users, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting privileges of users who can input data into the plugin and apply web application firewall (WAF) rules to detect and block XSS attempts. Monitor vendor channels for updates and apply patches promptly once available.