Bee Content Design Befree SDK Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Bee Content Design Befree SDK, specifically within the email builder feature. The issue arises in the Social Media icon URL parameter, where an attacker can inject arbitrary HTML and JavaScript. This injected content is executed when the preview page is accessed. However, due to the application's Content Security Policy, not all payloads will successfully execute. The vulnerability affects all versions prior to 3.47.0.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the email preview.

Remediation

Users can upgrade to Befree SDK version 3.47.0 or later to address this vulnerability.