CVE-2024-6169 is a stored cross-site scripting vulnerability in the Unlimited Elements For Elementor plugin for WordPress. It allows authenticated users with Contributor-level or higher privileges and plugin setting edit permissions to inject arbitrary web scripts through the 'username' parameter. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user input. This can lead to script execution in the context of other users viewing the affected pages. The vulnerability affects all versions up to and including 1.5.112. No patch or official fix information is provided in the available data.

An attacker with Contributor-level access and plugin setting edit permissions can inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to information disclosure or session hijacking limited to the scope of the affected site. The vulnerability does not impact availability and requires authenticated access with specific permissions, limiting the attack surface. The CVSS score of 6.4 reflects a medium severity impact with low complexity and no user interaction required beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level users from having plugin setting edit permissions. Limit access to trusted users only and monitor for suspicious activity related to plugin settings. Avoid granting unnecessary permissions that could allow script injection via the 'username' parameter.