CVE-2024-49225 in wpPricing Builder Plugin
Summary
by MITRE • 10/18/2024
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in swebdeveloper wpPricing Builder wppricing-builder-lite-responsive-pricing-table-builder allows Stored XSS.This issue affects wpPricing Builder: from n/a through <= 1.5.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/06/2026
The vulnerability CVE-2024-49225 represents a critical cross-site scripting flaw within the swebdeveloper wpPricing Builder plugin, specifically in the wppricing-builder-lite-responsive-pricing-table-builder component. This issue manifests as a stored XSS vulnerability that occurs during web page generation when processing user input, creating a persistent security risk for WordPress installations. The vulnerability affects all versions of the plugin up to and including version 1.5.0, indicating a widespread exposure across multiple deployment scenarios. The flaw stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase, allowing malicious actors to inject malicious scripts that persist in the database and execute whenever affected pages are loaded.
The technical implementation of this vulnerability follows the CWE-79 pattern for cross-site scripting, where user-supplied data is inadequately validated or escaped before being rendered in web pages. In the context of this WordPress plugin, when administrators or users input data into pricing table fields, the plugin fails to properly sanitize this input before storing it in the database. This stored data is then retrieved and displayed on frontend pages without proper HTML escaping, creating an environment where malicious JavaScript code can be executed in the context of other users' browsers. The stored nature of this vulnerability means that once malicious input is accepted and saved, it will continue to execute for all users who view the affected pages, making it particularly dangerous for administrative interfaces where privileged users might interact with the plugin.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with the ability to perform a range of malicious activities within the compromised environment. Attackers can leverage this vulnerability to steal session cookies, redirect users to malicious sites, deface the website content, or even escalate privileges if the targeted users have administrative access to the WordPress installation. The vulnerability's persistence through database storage means that even if the initial injection occurs during a brief window of time, the malicious payload continues to execute for all users who encounter the affected pages. This makes the vulnerability particularly dangerous in multi-user environments where administrators might unknowingly interact with compromised content, potentially leading to complete system compromise. The vulnerability also impacts the integrity of the website's content and user trust, as visitors may be exposed to malicious code execution without their knowledge.
Mitigation strategies for CVE-2024-49225 should prioritize immediate plugin updates to versions that address the XSS vulnerability, as the vendor has likely released patches to resolve the input sanitization issues. Organizations should implement comprehensive input validation and output escaping mechanisms throughout their WordPress installations, ensuring that all user-supplied data is properly sanitized before storage and rendering. Security teams should conduct thorough audits of all installed plugins to identify similar vulnerabilities, as this type of flaw is common in poorly secured web applications. Network-based mitigations including web application firewalls and content filtering systems can provide additional protection layers, though these should not be relied upon as primary defenses. Regular security monitoring and vulnerability scanning should be implemented to detect similar issues in other components of the WordPress ecosystem, following ATT&CK framework principles for defensive measures against persistent threats. The vulnerability also underscores the importance of maintaining up-to-date security practices and the necessity of regular security assessments to prevent exploitation of known weaknesses in web applications.