CVE-2024-1805: WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute
The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button onclick attribute in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1805?
CVE-2024-1805 is classified as a high severity vulnerability due to the potential for stored Cross-Site Scripting attacks.
How do I fix CVE-2024-1805?
To fix CVE-2024-1805, update the WPBakery Page Builder to version 7.6 or later, which addresses the input sanitization issues.
Who is affected by CVE-2024-1805?
CVE-2024-1805 affects all versions of the WPBakery plugin up to and including version 7.5.
Can authenticated attackers exploit CVE-2024-1805?
Yes, authenticated attackers with contributor access or higher can exploit CVE-2024-1805 to execute stored Cross-Site Scripting attacks.
What type of injection does CVE-2024-1805 involve?
CVE-2024-1805 involves stored Cross-Site Scripting due to insufficient sanitization in the button onclick attribute.