CVE-2024-5161 is a stored cross-site scripting vulnerability in the Magical Addons For Elementor WordPress plugin (Header Footer Builder, Free Elementor Widgets, Elementor Templates Library). The vulnerability exists due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the '_id' parameter. Authenticated users with Contributor-level privileges or higher can exploit this to inject arbitrary scripts that execute in the context of users viewing the compromised pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the '_id' parameter. These scripts execute in the browsers of users who access the infected pages, potentially leading to unauthorized actions or data disclosure within the context of the affected site. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider implementing additional input validation or web application firewall rules to detect and block malicious payloads targeting the '_id' parameter.