CVE-2024-4373

CVE-2024-4373 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Sina Extension for Elementor WordPress plugin, affecting all versions up to and including 3.5.3. This flaw, specifically within the Sina Particle Layer widget, stems from inadequate input sanitization and output escaping of user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages, which then execute when a user views the compromised page. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 24/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has garnered minimal community discussion and media coverage, suggesting it is not a high-profile threat at this time.