CVE-2024-2289

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link in multiple elements in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-228919.8Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.CVE-2024-228927.5OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.CVE-2024-228937.5OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers CVE-2024-228946.8An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 CVE-2024-228958.8DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.CVE-2024-228998.8Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime func CVE-2024-22907.2The Advanced Ads plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.52.1 via deserialization CVE-2024-229008.8Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardIn CVE-2024-229019.8Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.CVE-2024-229029.8Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.CVE-2024-229038.8Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK CVE-2024-229057.0Buffer Overflow vulnerability in ARM mbed-os v.6.17.0 allows a remote attacker to execute arbitrary code via a crafted script to the hciTrSe