CVE-2024-4400: 
WordPress vulnerability analysis and mitigation

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4400) discovered in versions up to and including 1.26.4. The vulnerability was disclosed on May 16, 2024, affecting WordPress installations using this plugin (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in an unknown parameter. This security flaw has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (Wordfence).

The vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack complexity is considered low, requiring no user interaction for successful exploitation (Wordfence).

A fix has been implemented in the WordPress plugin repository as evidenced by the changeset (WordPress Plugin). Users are advised to update their Post and Page Builder by BoldGrid plugin to the latest version available.