CVE-2024-9274

Summary

CVE-2024-9274 identifies a vulnerability in the Elastik Page Builder plugin for WordPress, affecting all versions up to and including 0.27.4, which allows for Stored Cross-Site Scripting (XSS) via SVG file uploads due to inadequate input sanitization. Authenticated attackers with Author-level access or higher can exploit this vulnerability to inject malicious scripts that execute when users access the compromised SVG files. To remediate this issue, it is recommended that organizations update the Elastik Page Builder plugin to a version beyond 0.27.4, where this vulnerability has been addressed. The potential danger posed by this vulnerability includes unauthorized data manipulation and possible phishing attacks, although its overall impact is rated as medium with low integrity and confidentiality implications according to CVSS scoring. Organizations should remain vigilant about maintaining updated plugins to mitigate such risks effectively.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.