CVE-2024-35768

This vulnerability allows an attacker to inject malicious scripts into web pages created with the Live Composer Page Builder, which can then be executed in the browsers of users who visit those pages. It affects versions from the earliest release up to 1.5.42, meaning if you're using one of those versions, your site could be at risk if proper input validation isn't implemented.

This vulnerability allows an attacker to inject malicious scripts into web pages created with the Live Composer Page Builder, which can then be executed in the browsers of users visiting those pages. It affects versions up to 1.5.23, and for the attack to work, the attacker needs to have access to a way to input content into the page builder.

This vulnerability allows attackers with contributor roles or higher to inject malicious scripts into web pages, potentially leading to Stored Cross-Site Scripting (XSS) attacks that can steal user data or hijack sessions. It occurs because the Page Builder plugin fails to properly check and clean up certain inputs before displaying them on the site.