CVE-2024-4700: 
WordPress vulnerability analysis and mitigation

The WP Table Builder WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the button element in versions up to and including 1.4.14. This vulnerability was discovered and reported by Wordfence, with the CVE identifier CVE-2024-4700 being assigned on May 9, 2024 (CVE Mitre).

The vulnerability stems from insufficient input sanitization and output escaping in the button element functionality. The issue has been assigned a CVSS v3.1 base score of 6.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity and requiring low privileges (NVD).

When exploited, this vulnerability allows authenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. While by default this can only be exploited by administrators, the ability to use and configure WP Table Builder can be extended to contributors, potentially increasing the attack surface (CVE Mitre).

The vulnerability requires authentication and low privileges to exploit. There are no public reports of this vulnerability being exploited in the wild at the time of assessment (NVD).

Users should update their WP Table Builder plugin to a version newer than 1.4.14 to address this vulnerability. The fix has been implemented in the plugin's codebase to properly sanitize and escape input in the button element functionality (WordPress Plugin).