CVE-2024-1840: 
WordPress vulnerability analysis and mitigation

The wpbakery plugin for WordPress (also known as WPBakery Page Builder) is vulnerable to Stored Cross-Site Scripting (XSS) via the Post Author tag attribute in versions up to and including 7.5. The vulnerability was discovered and reported on May 2, 2024 (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the Post Author tag attribute. This security flaw has been assigned a CVSS v3.1 Base Score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (Wordfence).

The vulnerability allows authenticated attackers with contributor access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized actions or data theft (NVD).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack complexity is considered low, as it doesn't require special conditions or circumstances to execute (Wordfence).

Users should update their WPBakery plugin to a version newer than 7.5 to address this vulnerability. The fix is available in the plugin's release notes (WPBakery KB).