CVE-2024-35779

This vulnerability allows an attacker to inject malicious scripts into web pages created with the Live Composer Page Builder, which can then execute when users visit those pages, potentially stealing sensitive information or hijacking user sessions. It affects versions from the earliest release up to 1.5.42, meaning any site using these versions is at risk if they allow untrusted input to be included in the page content.

This vulnerability allows an attacker to inject malicious scripts into web pages created with the Live Composer Page Builder, which can then be executed in the browsers of users visiting those pages. It affects versions up to 1.5.23, and for the attack to work, the attacker needs to have access to a way to input content into the page builder.

This vulnerability allows attackers with contributor roles or higher to inject malicious scripts into web pages, potentially leading to Stored Cross-Site Scripting (XSS) attacks that can steal user data or hijack sessions. It occurs because the Page Builder plugin fails to properly check and clean up certain inputs before displaying them on the site.