CVE-2024-8515 is a stored cross-site scripting vulnerability in the Themesflat Addons For Elementor WordPress plugin, affecting all versions up to and including 2.2.1. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of URL attributes in multiple widgets. Authenticated attackers with Contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the compromised pages. This can lead to partial confidentiality and integrity impacts without availability loss.

Successful exploitation allows authenticated users with Contributor-level access or above to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who visit the injected pages, potentially leading to information disclosure or manipulation of content. The CVSS score of 6.4 reflects a medium severity with low attack complexity, requiring privileges but no user interaction. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the affected widgets. Monitor for updates from the Themesflat vendor or WordPress plugin repository to apply any forthcoming patches promptly.