CVE-2024-3338: Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up to, and including, 1.0.262 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3338?
CVE-2024-3338 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting.
How do I fix CVE-2024-3338?
To fix CVE-2024-3338, you should update the Colibri Page Builder plugin to version 1.0.263 or later.
What versions of Colibri Page Builder are affected by CVE-2024-3338?
CVE-2024-3338 affects all versions of Colibri Page Builder up to and including 1.0.262.
Who can exploit the CVE-2024-3338 vulnerability?
Authenticated attackers with author-level access can exploit the CVE-2024-3338 vulnerability.
What type of vulnerability is CVE-2024-3338?
CVE-2024-3338 is a stored cross-site scripting (XSS) vulnerability.