PT-2021-15753 · WordPress · Wp Page Builder

Ramuel Gall · Published 2021-04-05 · Updated 2021-04-12 · CVE-2021-24208

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WP Page Builder WordPress plugin versions prior to 1.2.4

Description: The issue allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets. The “Custom HTML” widget requires sending a crafted request, as it uses client-side validation but not server-side validation. This insertion is done via the page builder data parameter when performing the wppb page save AJAX action. Additionally, malicious JavaScript can be inserted via the wppb page css parameter by closing out the style tag and opening a script tag during the wppb page save AJAX action.

Recommendations: For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider disabling the wppb page save AJAX action or restricting access to the page builder data and wppb page css parameters until a patch is available. Restrict the use of the “Raw HTML” and “Custom HTML” widgets to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24208

Affected Products

Wp Page Builder

References · 5

• 🔥 https://wpscan.com/vulnerability/c20e243d-b0de-4ae5-9a0d-b9d02c9b8141 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24208 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24208 · Vendor Advisory
• https://themeum.com/wp-page-builder-updated-v1-2-4 · Vendor Advisory
• https://t.me/cvenotify/13093 · Telegram Post