CVE-2024-5263 is a stored cross-site scripting vulnerability in the ElementsKit Pro plugin for WordPress, affecting all versions up to 3.6.2. The issue arises from improper neutralization of input in the Motion Text and Table widgets, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts. These scripts execute in the context of users who visit the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity). No known exploits in the wild have been reported. No patch or official fix information is currently provided.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages via vulnerable widgets. This can lead to unauthorized script execution in the browsers of users who view the injected content, potentially compromising user data confidentiality and integrity. The vulnerability does not affect availability. The impact is limited by the requirement for authenticated access at contributor level or above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the Motion Text and Table widgets in ElementsKit Pro. Monitor vendor channels for updates and apply patches promptly once released.