Vulnerability · Published Apr 5, 2021 · Assigned by WPScan

CVE-2021-24208WP Page Builder < 1.2.4 - Multiple Stored Cross-Site scripting (XSS)

Medium 5.4

In plain English

A medium-severity cross-site scripting in WP Page Builder from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium

Exploit odds (30 days)0.7%top 48.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets (though the custom HTML widget requires sending a crafted request - it appears that this widget uses some form of client side validation but not server side validation), all of which are added via the “page_builder_data” parameter when performing the “wppb_page_save” AJAX action. It is also possible to insert malicious JavaScript via the “wppb_page_css” parameter (this can be done by closing out the style tag and opening a script tag) when performing the “wppb_page_save” AJAX action.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Page Builder	1.2.4 – before 1.2.4

Weakness: CWE-79

References

https://www.themeum.com/wp-page-builder-updated-v1-2-4/ x_refsource_MISC
https://wpscan.com/vulnerability/c20e243d-b0de-4ae5-9a0d-b9d02c9b8141 x_refsource_CONFIRM