CVE-2024-50430: 
WordPress vulnerability analysis and mitigation

The Beaver Builder WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 2.8.3.7. This security issue was discovered and reported by João Pedro Soares de Alcântara, and was assigned CVE-2024-50430. The vulnerability affects the Beaver Builder plugin, which is a popular WordPress page builder tool (Patchstack, WPScan).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) with a CVSS v3.1 base score of 4.8 (Medium) according to NVD, and 5.9 (Medium) according to Patchstack. The vulnerability requires high privileges (Contributor level or above) and user interaction to be exploited. The attack vector is network-based with low attack complexity (NVD).

This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an injected page, potentially leading to various attacks including data theft, session hijacking, or defacement (WPScan).

The vulnerability has been patched in version 2.8.3.9 of the Beaver Builder plugin. Users are advised to update to this version or later to resolve the security issue (Patchstack).