Stored Cross-Site Scripting in Beaver Builder WordPress Page Builder Plugin

CVE-2024-0897

Summary

The Beaver Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input validation and output encoding. Authenticated attackers with contributor-level access or above can exploit this flaw by modifying the image URL parameter. This exploit allows injection of malicious scripts into webpages, which get executed when users visit the compromised pages, putting their session and data integrity at risk.

References