CVE-2024-2140: 
WordPress vulnerability analysis and mitigation

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress (versions up to and including 1.5.7) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2140) in its Advanced Icons widget component. The vulnerability was discovered and disclosed on March 29, 2024, affecting the plugin due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as a Stored Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 6.4 (Medium) according to Wordfence, and 5.4 (Medium) according to NVD. The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, and requiring low privileges (NVD).

When successfully exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized access to sensitive information or manipulation of user interactions (NVD).

The vulnerability requires an authenticated attacker with at least contributor-level access to the WordPress installation. The attack vector is through the Advanced Icons widget, where insufficient input sanitization and output escaping allow for the injection of malicious scripts (NVD).

The vulnerability has been patched in version 1.5.8 of the Ultimate Addons for Beaver Builder – Lite plugin. Users are strongly advised to update to this latest version to protect against potential exploitation (WordPress Plugin).