CVE-2024-9388 is a stored cross-site scripting vulnerability in the Black Widgets For Elementor plugin for WordPress, affecting all versions up to 1.3.7. The flaw allows authenticated users with Author-level access or above to upload SVG files containing malicious scripts. Due to improper neutralization of input during web page generation (CWE-79), these scripts execute in the context of users viewing the SVG, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with Author-level access can inject persistent malicious scripts via SVG uploads that execute in the browsers of users accessing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens. There is no direct impact on availability. The vulnerability requires authenticated access and affects the integrity and confidentiality of user sessions.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict Author-level access to trusted users only and consider disabling SVG uploads if possible. Implement additional input validation or filtering at the web server or application firewall level to block malicious SVG content.