Stored Cross-Site Scripting Vulnerability in Borderless Plugin for WordPress
CVE-2024-10867

5.4MEDIUM

Key Information:

Vendor
Visualmodo
Status
Borderless – Widgets, Elements, Templates And Toolkit For Elementor & Gutenberg
Vendor
CVE Published:
31 January 2025

Summary

The Borderless plugin for WordPress, which provides essential widgets, elements, and templates for Elementor and Gutenberg, has a serious vulnerability that allows authenticated attackers with Author-level access or higher to execute arbitrary web scripts. This vulnerability arises from insufficient input sanitization and output escaping when users upload SVG files. As a result, malicious scripts can be injected and executed whenever a user accesses the SVG file, leading to potential data theft, defacement, or malware distribution.

Affected Version(s)

Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg * <= 1.5.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/borderless/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
.