CVE-2024-4262

CVE-2024-4262 is a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions of the Piotnet Addons For Elementor WordPress plugin up to and including 2.4.28. This flaw allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied attributes within multiple widgets. The CVSS score of 7.2 (HIGH) indicates a significant risk, with a network-based attack vector and low attack complexity, potentially leading to unauthorized information disclosure and modification. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score of 46/100 still warrants attention. Currently, there is no evidence of active exploitation, nor is exploit code available in Metasploit, Nuclei, or ExploitDB. The vulnerability has also received minimal community discussion and media coverage, suggesting a low level of public awareness or immediate threat.