The vulnerability CVE-2024-49262 in the wepic Country Flags for Elementor plugin allows stored cross-site scripting due to improper input neutralization during web page generation. This affects all versions up to 1.0.1. The vulnerability can lead to the injection and execution of malicious scripts in the context of users interacting with the plugin's output. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and impacts on confidentiality, integrity, and availability at a low level. No official patch or remediation guidance has been published yet.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing affected pages, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. However, the impact is rated medium, reflecting limited scope and complexity. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the vulnerable plugin or applying any recommended temporary mitigations from the vendor once published. Monitor official vendor channels for updates.