CVE-2024-6848: Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 1.26.6 due to insufficient input sanitization and output escaping affecting the boldgridcanvasimage AJAX endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Post and Page Builder by BoldGrid – Visual Drag and Drop Editorto a version that resolves this vulnerability.Fixed in 1.26.6 - Compensating control
Since exploitation requires authenticated Contributor+ access and targets the boldgrid_canvas_image AJAX endpoint, restrict Contributor+ (and above) permissions for WordPress users who can upload files/submit content, and limit access to any endpoints related to boldgrid_canvas_image to trusted users/roles.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6848?
CVE-2024-6848 is considered a moderate severity vulnerability due to its potential for stored cross-site scripting.
How do I fix CVE-2024-6848?
To fix CVE-2024-6848, update the Post and Page Builder by BoldGrid plugin to version 1.26.7 or later, which addresses the vulnerability.
Which versions are affected by CVE-2024-6848?
CVE-2024-6848 affects all versions of the Post and Page Builder by BoldGrid up to and including version 1.26.6.
What type of vulnerability is CVE-2024-6848?
CVE-2024-6848 is a Stored Cross-Site Scripting vulnerability that arises from insufficient input sanitization and output escaping.
Can CVE-2024-6848 be exploited remotely?
Yes, CVE-2024-6848 can be exploited remotely if an attacker uploads malicious files to the affected WordPress site.