Stored Cross-Site Scripting Vulnerability in Beaver Builder Plugin for WordPress

CVE-2024-0871

What is CVE-2024-0871?

The Beaver Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Icon Widget parameters, specifically 'fl_builder_data[node_preview][link]' and 'fl_builder_data[settings][link_target]'. This vulnerability arises from inadequate input sanitization and output escaping. Authenticated users with contributor-level access or higher can exploit this issue by embedding malicious scripts into pages. When other users visit these compromised pages, the injected scripts are executed, potentially leading to further security breaches and data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References