CVE-2024-2142: 
WordPress vulnerability analysis and mitigation

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2142) in versions up to and including 1.5.7. The vulnerability exists in the Info Table widget due to insufficient input sanitization and output escaping (NVD).

The vulnerability affects the Info Table widget component of the plugin and stems from improper input sanitization and output escaping mechanisms. The CVSS v3.1 base score is 5.4 (Medium) according to NVD's assessment, with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Wordfence has assigned a slightly higher CVSS score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page. This can lead to potential data theft, session hijacking, or other malicious actions performed in the context of the visiting user's browser (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack vector is through the Info Table widget where malicious scripts can be injected due to improper input validation (NVD).

Users should update to a version newer than 1.5.7 of the Ultimate Addons for Beaver Builder – Lite plugin as soon as possible. If immediate updating is not possible, consider restricting access to the Info Table widget functionality to trusted administrators only (NVD).