CVE-2024-5501: 
WordPress vulnerability analysis and mitigation

The Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-5501) discovered in versions up to and including 2.5.51. The vulnerability was identified in June 2024 and affects the 'button_one_id' parameter due to insufficient input sanitization and output escaping (NVD).

The vulnerability stems from inadequate input sanitization and output escaping in the 'button_one_id' parameter. The issue has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating a network-accessible vulnerability requiring low attack complexity and low privileges (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least Contributor-level privileges to exploit. The attack can be executed remotely and requires low complexity to implement (NVD).

Users should update their Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder plugin to a version newer than 2.5.51 to address this vulnerability (NVD).