CVE-2024-1058: 
WordPress vulnerability analysis and mitigation

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the onclick parameter in versions up to and including 1.58.3. This vulnerability was identified in February 2024 and affects all installations of the plugin up to the specified version (Debian Tracker).

The vulnerability stems from insufficient input sanitization and output escaping in the SiteOrigin Widgets Bundle plugin. Specifically, the issue is related to the onclick parameter handling, which could allow for the injection of malicious scripts (Debian Tracker).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions or data theft (Debian Tracker).

The vulnerability can be exploited by authenticated users with contributor-level privileges or higher. This means that attackers need to have valid credentials with at least contributor access to the WordPress installation to exploit this vulnerability (Debian Tracker).

Version 1.58.3 provides a partial fix for this vulnerability. However, since this is noted as a partial fix, site administrators should implement additional security measures such as limiting contributor access and regularly monitoring for suspicious activities (Debian Tracker).