CVE-2024-37219: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Page Builder Sandwich – Front-End Page Builder WordPress plugin, affecting versions up to and including 5.1.0. The vulnerability was identified on June 21, 2024, and was assigned CVE-2024-37219. The issue affects the PBN Hosting SL Page Builder Sandwich – Front-End Page Builder plugin for WordPress (Patchstack, WPScan).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability requires low attack complexity, low privileges, and user interaction. The attack vector is network-based, with changed scope and low impact on both confidentiality and integrity (NVD).

The vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized actions or data theft (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack can be executed remotely over the network, though it requires user interaction to complete the exploit chain (Patchstack).

Currently, there is no official fix available for this vulnerability. The issue affects versions up to and including 5.1.0, and no patched version has been released (Patchstack).