CVE-2024-1842: 
WordPress vulnerability analysis and mitigation

The wpbakery plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-1842) discovered in all versions up to and including 7.5. The vulnerability was disclosed on May 2, 2024, affecting the Custom Heading tag attribute functionality (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the Custom Heading tag attribute. This security flaw has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with contributor-level privileges or higher to exploit. The attack complexity is considered low, requiring no user interaction for successful exploitation (NVD).

Users should update their WPBakery plugin to a version newer than 7.5 to address this vulnerability. The fix has been documented in the WPBakery release notes (WPBakery Docs).