CVE-2024-9064 is a stored cross-site scripting vulnerability in the Elementor Inline SVG WordPress plugin (versions up to 1.2.0). It results from improper neutralization of input during web page generation (CWE-79) specifically via SVG file uploads. Authenticated attackers with Author-level privileges or above can upload crafted SVG files containing malicious scripts that execute in the context of users viewing those files. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and scope change.

Successful exploitation allows an attacker with Author-level access to inject and execute arbitrary web scripts in the context of users accessing the SVG files. This can lead to partial compromise of confidentiality and integrity of user data or sessions within affected WordPress sites. There is no impact on availability. The vulnerability requires authenticated access, limiting exposure to users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and consider disabling or removing the Elementor Inline SVG plugin if possible. Monitor for updates from the vendor or plugin maintainers to apply an official fix once available.