exploitDog

CVE-2024-2509

Опубликовано: 05 апр. 2024

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Ссылки

https://research.cleantalk.org/cve-2024-2509/
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/
Exploit
Third Party Advisory
https://research.cleantalk.org/cve-2024-2509/
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:kadencewp:gutenberg_blocks_with_ai:*:*:*:*:*:wordpress:*:*

Версия до 3.2.26 (исключая)

EPSS

Процентиль: 44%

0.00213

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-w5wq-cvfc-3r8g

CVSS3: 6.5

github

почти 2 года назад

The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

EPSS

Процентиль: 44%

0.00213

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-79