Read the docs
TI-2021-06500 Aliases CVE-2021-24208GHSA-pf43-g47c-f3f8

WP Page Builder < 1.2.4 - Multiple Stored Cross-Site scripting (XSS)

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets (though the custom HTML widget requires sending a crafted request - it appears that this widget uses some form of client side validation but not server side validation), all of which are added via the “page_builder_data” parameter when performing the “wppb_page_save” AJAX action. It is also possible to insert malicious JavaScript via the “wppb_page_css” parameter (this can be done by closing out the style tag and opening a script tag) when performing the “wppb_page_save” AJAX action.

Why it matters now

EPSS 0.00658 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP Page Builder (Unknown): 1.2.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWP Page Builder1.2.4 to before 1.2.41.2.4Patch availableCNA
  • WP Page Builder VendorUnknown Affected 1.2.4 to before 1.2.4 Fixed in 1.2.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:themeum:wp_page_builder:*:*:*:*:*:wordpress:*:*before 1.2.4Vulnerablethemeum
  • cpe:2.3:a:themeum:wp_page_builder:*:*:*:*:*:wordpress:*:* Versions before 1.2.4 Vulnerable ·themeum

Remediation

  • Fix · CNA WP Page Builder (Unknown) Fixed in 1.2.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WP Page Builder 1.2.4

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-06499 WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to PostsPriority LOW 21
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24208
  2. 2026-10-03 Alias added: GHSA-pf43-g47c-f3f8
  3. 2026-10-09 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 1

  • TI-2022-03510 WP Page Builder <= 1.2.8 - Admin+ Stored Cross-Site CVSS 3.1MEDIUM 4.8
  • TI-2022-19506 WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities CVSS 3.1MEDIUM 5.4
  • TI-2021-06499 WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences