The themeshark ThemeShark Templates & Widgets for Elementor plugin versions up to 1.1.7 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with at least low privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability to a limited extent. The vulnerability is tracked as CVE-2024-51597 with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No patch or vendor advisory details are provided, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to stored XSS attacks, potentially allowing attackers to execute arbitrary scripts in the context of other users, which may result in limited confidentiality, integrity, and availability impacts. The CVSS vector indicates that an attacker requires low privileges and user interaction, and the vulnerability affects confidentiality, integrity, and availability to a limited degree. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges to trusted users and be cautious with input that can be stored and rendered by the plugin. Monitor vendor channels for updates and apply patches promptly once released.