CVE-2024-1058: WordPress SiteOrigin Widgets Bundle plugin vulnerable to Cross-Site Scripting (XSS). This flaw allows authenticated users (contributor role or higher) to inject malicious web scripts into pages due to inadequate sanitization. Exploitation occurs when a user views the compromised page, triggering the injected script.

The SiteOrigin Widgets Bundle plugin for WordPress, up to version 1.58.3, contains a stored Cross-Site Scripting (XSS) vulnerability, designated as CVE-2024-1058. This vulnerability arises from the inadequate input sanitization of the onclick parameter, allowing attackers with contributor access or higher to inject arbitrary web scripts. While a partial fix is available in version 1.58.3, the risk remains until fully patched. Though the CVSS score is 5.4, the SOCRadar Vulnerability Risk Score (SVRS) is 30, suggesting a lower immediate threat level, but the presence of "In The Wild" tag means exploitation is possible. Successful exploitation could lead to account compromise and website defacement. Address this promptly to avoid potential damage.