CVE-2024-54260

Vulnerability

Summary The vulnerability is a stored cross-site scripting (XSS) issue in the WordPress plugin News Kit Elementor Addons, versions up to and including 1.4.2. The plugin fails to properly neutralize user input during web page generation, leading to a stored XSS flaw [1].

Attack

Vector and Requirements Exploitation requires a user with at least Contributor-level privileges (or equivalent) to inject malicious scripts. The attacker can craft input that, when saved by the plugin, executes in the context of any visitor's browser. No direct user interaction is needed from the victim beyond normal browsing [1].

Impact

A successful attack allows an authenticated user to inject arbitrary JavaScript or HTML, which executes when other users or site visitors view the affected page. This could lead to session hijacking, redirection to malicious sites, or defacement [1].

Mitigation

Users should update the plugin to version 1.4.3 or later. No workaround is available; updating is the only effective remediation [1].