CVE-2024-1074: 
WordPress vulnerability analysis and mitigation

CVE-2024-1074 affects the Beaver Builder – WordPress Page Builder plugin for WordPress in versions up to and including 2.7.4.2. The vulnerability was discovered and reported by Wordfence, with the initial CVE record created on January 30, 2024 (CVE MITRE).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that exists in the audio widget's 'link_url' parameter. The issue stems from insufficient input sanitization and output escaping. The vulnerability has received a CVSS v3.1 base score of 5.4 (Medium) from NIST and 6.4 (Medium) from Wordfence (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor access or higher privileges to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (CVE MITRE).

The vulnerability requires authentication with at least contributor-level access to exploit. The attack complexity is considered low, requiring network access and user interaction for successful exploitation (NVD).

The vulnerability has been patched in version 2.7.4.3 of the Beaver Builder plugin. Users are advised to update to this version or later to mitigate the security risk (NVD).