CVE-2024-0897: 
WordPress vulnerability analysis and mitigation

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in versions up to 2.7.4.2. The vulnerability was addressed in version 2.7.4.3, released on February 7, 2024 (NVD).

The vulnerability is a Stored Cross-Site Scripting (XSS) issue that affects the image URL parameter in the Beaver Builder WordPress plugin. The security fix involved adding additional sanitization and escaping when rendering URLs to prevent XSS attacks (Wordfence).

A successful exploitation of this vulnerability could allow attackers to inject malicious scripts that would be stored in the database and executed when other users view the affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected users' browsers.

The vulnerability requires authentication to exploit, as an attacker would need access to the Beaver Builder plugin's interface to input malicious content via the image URL parameter.

Users should update to Beaver Builder version 2.7.4.3 or later, which includes the security fix for this vulnerability. The update adds additional sanitization and escaping mechanisms when handling URLs to prevent XSS attacks.