CVE-2024-8921 is a stored cross-site scripting vulnerability in the Zita Site Library for Elementor WordPress plugin. It occurs due to improper neutralization of input during web page generation, specifically via SVG file uploads. Authenticated users with Author-level privileges or higher can exploit this flaw to inject arbitrary web scripts that execute when the SVG file is accessed. The vulnerability affects all versions up to and including 1.6.3. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the Author level. No patch or vendor advisory is currently provided.

Successful exploitation allows an authenticated user with Author-level access or above to inject and execute arbitrary scripts in the context of users viewing the SVG files. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. There is no indication of availability impact. The vulnerability requires authenticated access, reducing the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from the vendor regarding patches or official mitigations.