Stored Cross-Site Scripting Vulnerability in Cards for Beaver Builder Plugin

CVE-2024-2305

Summary

The Cards for Beaver Builder plugin for WordPress has a vulnerability that allows authenticated attackers with contributor-level or higher permissions to perform Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping on user-supplied attributes, particularly in the BootstrapCard link. By exploiting this vulnerability, attackers can inject arbitrary web scripts into web pages, which will execute when users visit the compromised pages, potentially leading to unauthorized actions or data leakage.

References