The vulnerability CVE-2024-37936 in labibahmed's Tabs For WPBakery Page Builder plugin is a stored cross-site scripting (CWE-79) issue caused by improper input sanitization during web page generation. This flaw allows an attacker with limited privileges to inject malicious scripts that persist and execute in other users' browsers, potentially leading to confidentiality, integrity, and availability impacts. The affected versions include all releases up to 1.2. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality, integrity, and availability. No patch or official fix has been published yet.

Successful exploitation of this vulnerability can lead to stored cross-site scripting attacks, which may allow attackers to execute arbitrary scripts in the context of other users, potentially resulting in partial disclosure of information, modification of data, or disruption of service. The attack requires the attacker to have some privileges and user interaction is necessary. The vulnerability affects confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges to trusted users only and monitor for suspicious activity related to the plugin. Avoid allowing untrusted users to input data that is rendered by the Tabs For WPBakery Page Builder plugin. No official patch or temporary fix has been published at this time.