CVE-2024-5001 is a stored cross-site scripting vulnerability in the Image Hover Effects for Elementor with Lightbox and Flipbox WordPress plugin (versions up to 3.0.2). The issue stems from insufficient sanitization and escaping of specific input parameters ('_id', 'oxi_addons_f_title_tag', and 'content_description_tag'), allowing authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript code. This code executes in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability is related to CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no vendor advisory or patch link available at this time, and no known active exploitation has been reported.

Successful exploitation allows authenticated users with Contributor-level access or above to inject persistent malicious scripts into pages. These scripts execute whenever any user accesses the affected page, potentially leading to information disclosure (partial confidentiality impact) and integrity loss (partial integrity impact). Availability is not impacted. The vulnerability could facilitate session hijacking or other client-side attacks but requires authenticated access to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only. Consider removing or disabling the vulnerable plugin if feasible. Monitor for updates from the plugin developer or WordPress security channels for a patch or official mitigation instructions.