CVE-2024-9505

Name of the Vulnerable Software and Affected Versions The Beaver Builder – WordPress Page Builder plugin versions up to, and including, 2.8.4.2

Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's Button widget, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages. These scripts will execute whenever a user accesses an injected page.

Recommendations For versions up to, and including, 2.8.4.2, update to a version higher than 2.8.4.2 to resolve the issue. As a temporary workaround, consider restricting access to the Button widget for users with contributor-level access and above until a patch is available.