CVE-2024-2163 is a stored cross-site scripting vulnerability in the Ninja Beaver Add-ons for Beaver Builder WordPress plugin. The issue arises from improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied attributes like URLs in plugin widgets. This allows authenticated users with contributor or higher privileges to inject arbitrary scripts that execute in the context of other users viewing the affected pages. The vulnerability affects all plugin versions up to and including 2.4.5. CVE-2024-37244 is likely a duplicate of this issue. The CVSS 3.1 base score is 6.4, reflecting a network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with contributor-level or higher permissions can inject malicious scripts into pages via plugin widgets. These scripts execute in the browsers of users who view the compromised pages, potentially leading to unauthorized actions or data disclosure within the context of the affected site. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the Ninja Beaver Add-ons for Beaver Builder plugin if possible. Monitor official vendor channels for updates and apply patches promptly once released.