CVE-2024-1157: 
WordPress vulnerability analysis and mitigation

The Bold Page Builder plugin for WordPress (versions up to and including 4.8.0) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-1157) discovered in February 2024. The vulnerability exists in the plugin's button URL functionality due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 5.4 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C) with low confidentiality (C:L) and integrity (I:L) impacts, and no availability impact (A:N) (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attacker must have access to the WordPress installation and the ability to create or edit pages using the Bold Page Builder plugin (NVD).

Users should upgrade to version 4.8.1 or later of the Bold Page Builder plugin, which contains fixes for this vulnerability (NVD).