CVE-2024-2305: 
WordPress vulnerability analysis and mitigation

The Cards for Beaver Builder plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2305) discovered in versions up to and including 1.1.2. The vulnerability was disclosed on April 9, 2024, affecting the BootstrapCard link functionality (NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the BootstrapCard link feature. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigned a score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires authentication with at least contributor-level access to exploit. The attack complexity is considered low, requiring network access and user interaction for successful exploitation (NVD).

Users are advised to update to version 1.1.3 or later of the Cards for Beaver Builder plugin, which contains patches for this vulnerability (WordPress Patch).