CVE-2024-2289: 
WordPress vulnerability analysis and mitigation

The PowerPack Lite for Beaver Builder plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2289) affecting all versions up to and including 1.3.0. The vulnerability was discovered and disclosed on April 9, 2024, with a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes in the link element across multiple components. This security flaw allows authenticated users with contributor-level permissions or higher to inject arbitrary web scripts into pages (NVD).

When successfully exploited, the vulnerability allows attackers to inject malicious scripts that will execute whenever a user accesses the compromised page. This could potentially lead to client-side attacks against site visitors (NVD).

The vulnerability requires authentication with at least contributor-level access to exploit. The attack complexity is considered low, as indicated by the CVSS score of 6.4 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) (Wordfence).

A patch has been released to address this vulnerability. Users should update their PowerPack Lite for Beaver Builder plugin to a version newer than 1.3.0 (WordPress Plugins).