CVE-2021-24243CWE-79

WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS)

published May 5, 2021

CVSS
—
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00703 · 52.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-05-05T18:39Z
EPSS history
Timeline
  • 05 MAY 18:39Z
    WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS)
    cvelistv5