CVE-2024-12240

The Page Builder by SiteOrigin plugin contains a stored cross-site scripting vulnerability in versions 2.31.0 and earlier through improper handling of the row label parameter, allowing users with Contributor role or higher permissions to inject malicious scripts into pages that execute for any visitor viewing those pages. The issue stems from inadequate sanitization of user input combined with insufficient escaping of output. This vulnerability affects all versions up to and including 2.31.0 and has been patched in version 2.31.1.

Based on public CVE data (MITRE/NVD).