CVE-2024-12117 is a stored cross-site scripting vulnerability (CWE-79) in the Stackable – Page Builder Gutenberg Blocks WordPress plugin. It occurs due to improper neutralization of input in the 'title' parameter of the Button block, allowing authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute whenever a user accesses the injected page, potentially impacting confidentiality and integrity. The vulnerability affects all versions up to 3.13.11. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and scope change with limited confidentiality and integrity impact but no availability impact.

An attacker with Contributor-level access or above can store malicious scripts in the 'title' parameter of the Button block. These scripts execute in the context of users viewing the affected pages, potentially leading to unauthorized actions or data disclosure within the WordPress site. The impact is limited to confidentiality and integrity with no availability impact. There are no reports of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access and above to trusted users only. Monitor for plugin updates from bfintal and apply them promptly once available. Avoid using the vulnerable Button block 'title' parameter for untrusted input.