CVE-2024-30179: 
WordPress vulnerability analysis and mitigation

The Bold Page Builder WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-30179) affecting versions up to and including 4.7.6. The vulnerability was discovered on March 25, 2024, and allows authenticated users with contributor-level access or higher to inject malicious web scripts via the CSS class parameter (WPScan, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 5.4 (Medium) from NVD and 6.5 (Medium) from Patchstack. The issue stems from insufficient input sanitization and output escaping in the CSS class functionality, which allows for the injection of arbitrary web scripts that execute when users access the affected pages (NVD).

When successfully exploited, this vulnerability allows attackers to inject malicious scripts that will execute whenever a user accesses an injected page. This can lead to various attacks including redirects, unauthorized advertisements, and other malicious HTML payloads being executed in visitors' browsers (Patchstack).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) with user interaction (UI:R) (NVD).

The vulnerability has been patched in version 4.7.7 of the Bold Page Builder plugin. Users are advised to update to this version or later to remediate the security issue (Patchstack).