Page Builder Plugin Vulnerable to Stored Cross-Site Scripting

CVE-2024-2202

Summary

The Page Builder by SiteOrigin plugin for WordPress has a vulnerability allowing for Stored Cross-Site Scripting. This issue arises from inadequate input sanitization and output escaping in the legacy Image widget. Authenticated attackers with contributor-level access and above can exploit this vulnerability to inject arbitrary web scripts into pages. The injected scripts will execute when users access the affected pages, potentially leading to unauthorized actions or data exposure.

References