CVE-2024-5663

Vulnerability

Analysis

What the vulnerability is

The Cards for Beaver Builder plugin for WordPress [1] contains a stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.1.3. The root cause is insufficient input sanitization and output escaping on user-supplied attributes in the plugin's Cards widget [description]. This allows malicious input to be stored and later rendered unsafely in the browser.

Attack exploitation

To exploit this vulnerability, an attacker must be an authenticated user with at least contributor-level access to the WordPress site. The attacker can inject arbitrary web scripts (such as JavaScript) into the Cards widget's attributes. When a page containing the malicious card is accessed by another user (including administrators or regular visitors), the injected script executes in their browser session [description].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement of the site, redirection to malicious sites, or theft of sensitive information like login cookies. The CVSS score of 6.4 (Medium) reflects the need for some level of authenticated access but the potential for wide impact once executed [Severity].

Mitigation

The vendor has not released a patched version; users should update if a fix becomes available. As a workaround, contributor and higher roles should be carefully audited, and output escaping should be reviewed. No evidence of inclusion in CISA KEV was noted at publication.