CVE-2024-1590 is a stored cross-site scripting vulnerability in the Page Builder: Pagelayer WordPress plugin, specifically in the Button Widget. The flaw is due to improper neutralization of input during web page generation, allowing authenticated users with contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to limited confidentiality and integrity impacts. The vulnerability affects all versions up to 1.8.2. The CVSS 3.1 base score is 4.6 (medium), with attack vector network, low attack complexity, requiring privileges, and user interaction.

Successful exploitation allows an authenticated contributor or higher user to inject and store malicious scripts in pages created with the plugin. These scripts execute in the browsers of users who view the infected pages, potentially leading to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no impact on availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or replacing the plugin if possible. Monitor for plugin updates from the vendor that address this vulnerability.