WordPress Page Builder by SiteOrigin plugin <= 2.29.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode vulnerability

🗓️ 21 May 2024 03:46:55Reported by stealthcopterType

Authenticated stored Cross Site Scripting in WordPress Page Builder by SiteOrigin (Version 2.29.15) via the siteorigin_widget shortcode.

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress Plugin Page Builder by SiteOrigin 跨站脚本漏洞	21 May 202400:00	–	cnnvd
CVE	CVE-2024-4361	21 May 202411:02	–	cve
Cvelist	CVE-2024-4361 Page Builder by SiteOrigin <= 2.29.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode	21 May 202411:02	–	cvelist
EUVD	EUVD-2024-43997	3 Oct 202520:07	–	euvd
NVD	CVE-2024-4361	21 May 202411:15	–	nvd
Patchstack	WordPress Page Builder by SiteOrigin Plugin <= 2.29.15 is vulnerable to Cross Site Scripting (XSS)	21 May 202400:00	–	patchstack
Positive Technologies	PT-2024-30604 · Siteorigin · The Page Builder By Siteorigin	21 May 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-4361	23 May 202508:55	–	redhatcve
Vulnrichment	CVE-2024-4361 Page Builder by SiteOrigin <= 2.29.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode	21 May 202411:02	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (May 20, 2024 to May 26, 2024)	30 May 202415:23	–	wordfence

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/siteorigin-panels/page-builder-by-siteorigin-22915-authenticated-contributor-stored-cross-site-scripting-via-siteorigin-widget-shortcode

21 May 2024 03:46Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.4 - 6.4

EPSS0.0036

SSVC