CVE-2024-5255 is a stored cross-site scripting vulnerability in the Ultimate Addons for WPBakery WordPress plugin, specifically in the ultimate_dual_color shortcode. The flaw is due to improper neutralization of input during web page generation, allowing authenticated users with contributor-level access or higher to inject malicious scripts via user-supplied shortcode attributes. These scripts execute in the context of any user viewing the compromised page, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 3.19.20. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity. No known exploits in the wild or patch links are currently documented.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially exposing sensitive information or enabling further attacks such as session hijacking. The vulnerability does not affect availability. The medium CVSS score reflects the need for authenticated access but low complexity of exploitation and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable shortcode if possible. Monitor for updates from Brainstorm Force regarding patches or official mitigations.