CVE-2024-4362

The SiteOrigin Widgets Bundle plugin through version 1.60.0 contains a Stored Cross-Site Scripting vulnerability in its 'siteorigin_widget' shortcode that arises from inadequate sanitization of user-supplied shortcode attributes and insufficient output escaping. Attackers with contributor-level permissions or higher can exploit this flaw to embed malicious scripts into pages, which execute when visitors access the compromised content. The vulnerability affects all versions up to and including 1.60.0, with a fix available in version 1.61.0 and later.

Based on public CVE data (MITRE/NVD).