CVE-2024-5663: 
WordPress vulnerability analysis and mitigation

The Cards for Beaver Builder WordPress plugin (versions up to and including 1.1.3) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-5663). The vulnerability was discovered in the plugin's Cards widget due to insufficient input sanitization and output escaping on user-supplied attributes (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has received a CVSS v3.1 base score of 5.4 (Medium) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigned a score of 6.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack complexity is considered low, requiring network access and no special conditions for exploitation (NVD).

Users should update to version 1.1.4 or later of the Cards for Beaver Builder plugin, which contains security fixes for this vulnerability (WordPress Plugin).