CVE-2024-9657

CVE-2024-9657 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Element Pack Elementor Addons plugin for WordPress, specifically in versions up to and including 5.10.2. This flaw allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages via the 'tooltip' parameter due to insufficient input sanitization. When a user accesses an affected page, these scripts will execute, potentially leading to session hijacking or defacement. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. While it is not currently listed on the CISA KEV catalog or Hot List, and there are no known public exploits (Metasploit, Nuclei, ExploitDB), its EPSS score is low, suggesting a low probability of exploitation. There is also no significant community discussion or media coverage surrounding this CVE.