CVE-2024-5038: 
WordPress vulnerability analysis and mitigation

The Colibri Page Builder plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-5038) affecting all versions up to and including 1.0.276. The vulnerability was discovered and reported by Wordfence, with the disclosure date of June 6, 2024 (NVD CVE).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode(s). This security flaw has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Wordfence has assigned a slightly higher CVSS score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD CVE).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD CVE).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack vector is network-accessible, requires low attack complexity, and can be executed with low privileges (NVD CVE).

Users should update their Colibri Page Builder plugin to version 1.0.277 or later, which contains the security fix. The patch has been documented in the WordPress plugin repository (WordPress Plugin).