CVE-2024-2185
Last modified
CVE-2024-2185 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wpzoom | Beaver Builder Addons | < 1.3.5 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-2185?
How severe is CVE-2024-2185?
How do I fix CVE-2024-2185?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-21843Uncontrolled search path for some Intel(R) Computing Improve…6.7
- CVE-2024-21844Integer overflow in firmware for some Intel(R) CSME may allo…5.3
- CVE-2024-21845 in OpenHarmony v4.0.0 and prior versions allow a local atta…7.8
- CVE-2024-21846An unauthenticated attacker can reset the board and stop tra…6.9
- CVE-2024-21848Improper Access Control in Mattermost Server versions 8.1.x …3.1
- CVE-2024-21849 When an Advanced WAF/ASM security policy and a Websockets…7.5
- CVE-2024-21850Sensitive information in resource not removed before reuse i…8.3
- CVE-2024-21851 in OpenHarmony v4.0.0 and prior versions allow a local atta…7.8
- CVE-2024-21852In Rapid Software LLC's Rapid SCADA versions prior to Versio…8.8
- CVE-2024-21853Improper finite state machines (FSMs) in the hardware logic …5.7
- CVE-2024-21855A lack of authentication vulnerability exists in the HTTP AP…9.8
- CVE-2024-21856Rejected reason: This candidate was in a CNA pool that was n…
Are you affected by CVE-2024-2185?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST