CVE-2024-1157: Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, and including, 4.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1157?
CVE-2024-1157 is considered a medium severity vulnerability due to its potential for Stored Cross-Site Scripting.
How do I fix CVE-2024-1157?
To fix CVE-2024-1157, update the Bold Page Builder plugin to version 4.8.1 or later, where this issue has been addressed.
Who is affected by CVE-2024-1157?
Authenticated users with contributor-level access or higher are vulnerable to CVE-2024-1157 in all versions up to 4.8.0.
What causes CVE-2024-1157?
CVE-2024-1157 is caused by insufficient input sanitization and output escaping in the plugin's button URL functionality.
What type of vulnerability is CVE-2024-1157?
CVE-2024-1157 is a Stored Cross-Site Scripting (XSS) vulnerability impacting the Bold Page Builder plugin.