Stored Cross-Site Scripting Vulnerability in Team Builder Plugin for WPBakery Page Builder

CVE-2024-13591

Summary

The Team Builder for WPBakery Page Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting attack due to insufficient input sanitization and output escaping on user-supplied attributes. This vulnerability is present in all versions up to and including 1.0. Authenticated attackers with contributor-level access or higher can exploit this flaw using the 'team-builder-vc' shortcode, allowing them to inject arbitrary web scripts into pages. These scripts will execute when users access the compromised pages, posing significant risks to user data and site integrity.

References