CVE-2024-4980 is a stored cross-site scripting vulnerability in the WPKoi Templates for Elementor plugin for WordPress. The flaw arises from improper neutralization of input during web page generation, specifically in the 'id', 'mixColor', 'backgroundColor', 'saveInCookies', and 'autoMatchOsTheme' parameters. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of users visiting the injected pages. This vulnerability affects all plugin versions up to and including 2.5.9. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to partial confidentiality and integrity loss, such as theft of cookies or session tokens, but does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access and above to trusted users only. Monitor plugin updates from wpkoithemes and apply any released patches promptly to remediate this vulnerability.