CVE-2024-1840: WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Author tag attribute in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1840?
CVE-2024-1840 has a high severity due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2024-1840?
To fix CVE-2024-1840, you should update the WPBakery Page Builder plugin to version 7.6 or later.
Who is affected by CVE-2024-1840?
CVE-2024-1840 affects all versions of the WPBakery Page Builder plugin up to and including version 7.5.
What are the risks associated with CVE-2024-1840?
The risks associated with CVE-2024-1840 include unauthorized script execution in the context of the affected website, potentially compromising user data.
Is user authentication required to exploit CVE-2024-1840?
Yes, CVE-2024-1840 requires authenticated user access, specifically contributor level or higher, to exploit the vulnerability.