CVE-2024-5341 is a stored cross-site scripting vulnerability in The Plus Addons for Elementor Page Builder Pro WordPress plugin. The flaw exists in the handling of the 'size' attribute of the Heading Title widget, where user input is not properly sanitized or escaped before being rendered on web pages. This allows authenticated users with contributor-level privileges or higher to inject malicious scripts that persist in the page content and execute in the browsers of users who view the page. The vulnerability affects all versions up to 5.5.4. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and partial impact on confidentiality and integrity without availability impact.

An attacker with contributor-level or higher access can exploit this vulnerability to inject and store malicious scripts in pages using the Heading Title widget. These scripts execute in the context of users viewing the affected pages, potentially leading to unauthorized actions such as session hijacking or data theft. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the vulnerable widget if possible. Monitor vendor channels for updates and apply official patches promptly once released.