CVE-2024-2202

CVE-2024-2202 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Page Builder by SiteOrigin plugin for WordPress, specifically through its legacy Image widget in versions up to and including 2.29.6. This flaw allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages due to insufficient input sanitization and output escaping. When a user views an affected page, these scripts will execute, potentially leading to information disclosure or session hijacking. The vulnerability carries a CVSS score of 5.4 (Medium), indicating that it can be exploited remotely with low attack complexity, requiring user interaction. While the impact on confidentiality and integrity is low, the scope is changed, meaning the vulnerability affects resources beyond the attacker's authorization. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in frameworks like Metasploit or Nuclei, or on ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting a low level of public awareness or immediate concern.