This vulnerability (CVE-2024-51575) involves improper input neutralization in the Extender All In One For Elementor plugin, leading to stored cross-site scripting (XSS). An attacker can inject malicious scripts that are stored by the application and executed when viewed by other users. The affected versions are up to 1.0.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and low impact on confidentiality, integrity, and availability. No patch or official fix has been published yet.

Successful exploitation could allow an attacker with some privileges and requiring user interaction to execute arbitrary scripts in the context of affected users, potentially leading to data disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability at a low level. The vulnerability is rated medium severity with a CVSS score of 6.5. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting plugin usage to trusted users with minimal privileges and avoid interacting with untrusted content. Monitor official sources for updates and apply patches promptly once released.