CVE-2024-5041 is a stored cross-site scripting vulnerability in the Happy Addons for Elementor plugin for WordPress. The flaw exists in the handling of the ‘ha-ia-content-button’ parameter, allowing authenticated attackers with Contributor-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 3.10.9 and is due to improper neutralization of input during web page generation (CWE-79).

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject malicious scripts that execute in the browsers of users who view the infected pages. This can lead to information disclosure or session hijacking. The CVSS score is 6.4 (medium severity) reflecting network attack vector, low attack complexity, and limited privileges required.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor advisory for updates and apply any official patches once released. Until then, restrict Contributor-level access to trusted users and consider disabling or limiting use of the vulnerable parameter if possible.