CVE-2024-2144: 
WordPress vulnerability analysis and mitigation

The Ultimate Addons for Beaver Builder – Lite plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2144) in versions up to and including 1.5.7. The vulnerability exists in the Image Separator widget due to insufficient input sanitization and output escaping (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue stems from improper input validation and output escaping in the Image Separator widget component, which allows authenticated users with contributor-level access or higher to inject malicious scripts (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level privileges to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the compromised page, potentially leading to various malicious activities such as data theft, session hijacking, or defacement (NVD).

The vulnerability requires an authenticated user with contributor-level access or higher privileges to exploit. The attack complexity is considered low, but user interaction is required for successful exploitation (NVD).

Users are advised to update to version 1.5.8 or later of the Ultimate Addons for Beaver Builder – Lite plugin, which contains the fix for this vulnerability (Patchstack).