CVE-2024-4564: 
WordPress vulnerability analysis and mitigation

The CoDesigner WooCommerce Builder for Elementor plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4564) affecting versions up to and including 4.4.1. The vulnerability exists in the plugin's Shop Slider, Tabs Classic, and Image Comparison widgets due to insufficient input sanitization and output escaping on user-supplied attributes (Wordfence).

The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue stems from improper sanitization of user input in multiple widget components, specifically in the Shop Slider, Tabs Classic, and Image Comparison widgets (NVD).

This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions or data theft (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, as it doesn't require special conditions or circumstances to execute (Wordfence).

The vulnerability has been addressed in versions after 4.4.1. Users are advised to update their CoDesigner WooCommerce Builder for Elementor plugin to the latest version to protect against this security issue (WordPress Plugin).