CVE-2024-6627 is a stored cross-site scripting vulnerability (CWE-79) in the Happy Addons for Elementor WordPress plugin, specifically in the PDF View widget. The flaw is due to improper neutralization of input during web page generation, allowing authenticated users with contributor-level privileges or above to inject malicious scripts. These scripts execute in the context of users who visit the compromised pages. The vulnerability affects all versions up to 3.11.2. No known exploits are reported in the wild, and no patch or remediation details are currently available.

Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires user interaction (visiting the injected page). The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the PDF View widget if feasible. Monitor for updates from the vendor or plugin maintainers regarding patches or official mitigations.