Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24243

WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

bitorbit WPBakery Page Builder (Visual Composer) Clipboard

  • 4.5.0 to < 4.5.0*affected
  • 4.5.6 to < 4.5.6affected

References