CVE-2024-43320: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Livemesh Addons for WPBakery Page Builder WordPress plugin, affecting versions up to 3.9. The vulnerability was identified on August 16, 2024, and was assigned CVE-2024-43320. The issue allows authenticated users with Contributor or higher privileges to inject malicious scripts into web pages (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79). It received a CVSS v3.1 score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction to exploit (Patchstack).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected pages (Patchstack).

The vulnerability requires an authenticated user with at least Contributor-level privileges to exploit. It was initially reported by researcher LVT-tholv2k on July 25, 2024 (Patchstack).

The vulnerability has been patched in version 3.9.1 of the Livemesh Addons for WPBakery Page Builder plugin. Users are advised to update to version 3.9.1 or later to remediate the security issue (Patchstack).