The Extensions for Elementor plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-5666. This vulnerability exists due to improper neutralization of input in the ‘url’ parameter of the EE Button widget, allowing authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code. The injected scripts execute in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 2.0.30. There is no indication of known exploits in the wild or an available patch at this time.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into pages via the ‘url’ parameter of the EE Button widget. These scripts execute in the browsers of users who visit the infected pages, potentially leading to theft of user credentials, session tokens, or other malicious actions limited to the scope of the injected script. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent as reflected by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the EE Button widget if feasible. Monitor for updates from the plugin vendor or WordPress plugin repository for a security update addressing this issue.