CVE-2024-8282mediumCWE-79

CVE-2024-8282: fallo de gravedad media en vowelweb Ibtana – WordPress Website Builder

Ibtana – WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Ibtana – WordPress Website Builder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.4epss 0.3%
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:ive/ive-productscarousel' Gutenberg block in all versions up to, and including, 1.2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
vowelweb · Ibtana – WordPress Website Builder
CVEs relacionadas — vowelweb Ibtana – WordPress Website Builder

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-5541MEDIUMIbtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings UpdateEPSS 0.5%CVE-2023-6684MEDIUMIbtana – WordPress Website Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-5092MEDIUMMultiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript LibraryEPSS 0.3%CVE-2026-1834MEDIUMIbtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%