Stored Cross-Site Scripting Vulnerability in Beaver Builder Plugin for WordPress

CVE-2024-0871

Summary

The Beaver Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Icon Widget parameters, specifically 'fl_builder_data[node_preview][link]' and 'fl_builder_data[settings][link_target]'. This vulnerability arises from inadequate input sanitization and output escaping. Authenticated users with contributor-level access or higher can exploit this issue by embedding malicious scripts into pages. When other users visit these compromised pages, the injected scripts are executed, potentially leading to further security breaches and data exposure.

References