CVE-2024-2504 is a stored cross-site scripting vulnerability in the softaculous Page Builder: Pagelayer – Drag and Drop website builder WordPress plugin. The issue exists in all versions up to and including 1.8.4 due to improper neutralization of input in the 'attr' parameter, allowing authenticated users with contributor-level permissions or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses the injected page, potentially leading to information disclosure or session hijacking. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.4 (medium severity). No patch or official remediation guidance is currently available.

An authenticated attacker with contributor-level access or higher can exploit this vulnerability to inject and store malicious scripts in pages created with the plugin. These scripts execute in the context of users who view the compromised pages, potentially leading to information disclosure or other client-side impacts. There is no indication of impact to system availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible to prevent exploitation.