CVE-2024-2187

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonials widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-218704.9A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A CVE-2024-218717.5Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of priv CVE-2024-218727.5The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more critic CVE-2024-218756.5Allocation of Resources Without Limits or Throttling vulnerability in Badge leading to a denial of service attack.Team Hacker Hotel Badge 20 CVE-2024-218769.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (form CVE-2024-218776.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (CVE-2024-218789.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as E CVE-2024-218798.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticat CVE-2024-21886.1Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability c CVE-2024-218807.2Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated CVE-2024-218818.6Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.T CVE-2024-218857.8A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certa