CVE-2024-51680 is a stored cross-site scripting vulnerability affecting Cresta Addons for Elementor up to version 1.0.9. The issue stems from improper input sanitization during web page generation, enabling attackers with low privileges and requiring user interaction to inject malicious scripts. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No patch or official fix details are currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute stored malicious scripts in the context of affected users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected web application. The vulnerability requires user interaction and can affect multiple users due to its stored nature. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input capabilities and applying web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS. Monitor vendor channels for updates and apply patches promptly once released.