CVE-2024-34757: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Visualmodo Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg WordPress plugin. The vulnerability affects versions through 1.5.3 and was reported on March 28, 2024, with public disclosure occurring on May 14, 2024. The vulnerability was assigned identifier CVE-2024-34757 (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires contributor-level privileges to exploit (Patchstack).

If exploited, this vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability requires contributor-level access to exploit, and has been assessed as having a low priority for patching due to the limited potential for exploitation (Patchstack).

As of the latest reports, no official fix is available for this vulnerability. The issue affects versions up to 1.6.4 of the Borderless plugin (Patchstack).