CVE-2024-30450: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin, affecting versions up to and including 1.1.1. The vulnerability was discovered by researcher LVT-tholv2k and was publicly disclosed on March 28, 2024 (WPScan, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has been assigned CVE-2024-30450. It received a CVSS v3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The issue stems from insufficient input sanitization and output escaping in the plugin's functionality (NVD, Patchstack).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions, data theft, or site defacement (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. While this requirement somewhat limits the potential attack surface, the low complexity of exploitation makes it a significant security concern (Patchstack).

The vulnerability has been fixed in version 1.1.2 of the plugin. Site administrators are strongly advised to update to this version or later to resolve the security issue. Additionally, Patchstack has issued a virtual patch to mitigate this vulnerability by blocking potential attacks until users can update to the fixed version (Patchstack).