CVE-2024-49654 describes a reflected cross-site scripting vulnerability in the Extra Privacy for Elementor plugin by Marian Heddesheimer. The issue is caused by improper neutralization of input during web page generation, which allows attackers to inject and execute arbitrary scripts in users' browsers. This affects versions up to 0.1.3 of the plugin. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory with remediation details is currently available. The plugin is not a cloud service, so remediation depends on applying updates from the vendor.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure, modification of data, or disruption of service. The reflected XSS can be triggered remotely without privileges but requires user interaction. The CVSS score of 7.1 indicates a high severity impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor official sources for updates and apply any official fixes promptly once released.