CVE-2024-2079

Summary

CVE-2024-2079 is a stored Cross-Site Scripting (XSS) vulnerability affecting the WPBakery Page Builder Addons plugin by Livemesh for WordPress. Versions up to 3.8.1 are susceptible to this issue, which enables authenticated attackers with contributor-level access and above to inject malicious scripts. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's 'per_line_mobile' shortcode. Successful exploitation allows attackers to execute arbitrary web scripts whenever a user accesses an injected page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.