CVE-2024-7100: 
WordPress vulnerability analysis and mitigation

The Bold Page Builder plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-7100) in versions up to and including 5.0.2. The vulnerability exists in the plugin's bt_bb_button shortcode due to insufficient input sanitization and output escaping on user-supplied attributes (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 5.4 (Medium) according to NVD, and 6.4 (Medium) according to Wordfence. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L). The vulnerability affects the plugin's bt_bb_button shortcode functionality where user input is not properly sanitized (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized actions or data theft (NVD).

The vulnerability requires an authenticated user with contributor-level privileges or higher to exploit. The attacker needs to have the ability to create or edit pages using the Bold Page Builder plugin to inject malicious scripts through the bt_bb_button shortcode (NVD).

Users should update to version 5.0.3 or later of the Bold Page Builder plugin, which contains patches for this vulnerability. The fix has been implemented in the plugin's source code and is available through the WordPress plugin repository (WordPress Plugin).