CVE-2024-4361

The Page Builder by SiteOrigin plugin contains a stored cross-site scripting vulnerability through its 'siteorigin_widget' shortcode in versions up to 2.29.15. Authenticated users with contributor access or higher can inject malicious scripts into pages by exploiting inadequate sanitization and escaping of shortcode attributes. When other users visit pages containing the malicious shortcode, the injected scripts execute in their browsers.

Based on public CVE data (MITRE/NVD).