CVE-2024-9049

Summary

CVE-2024-9049 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Beaver Builder WordPress Page Builder plugin. This issue, present in versions up to 2.8.3.6, allows authenticated attackers with contributor-level access or higher to inject malicious scripts into the Button Group module. These scripts can execute whenever a user visits an injected page, potentially leading to unintended actions or data exposure. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied attributes, enabling attackers to exploit this weakness.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.