Lucene search

WpvulndbWPVDB-ID:ECE1C296-86FC-41B7-A66C-25F3CE632E64

HistoryApr 12, 2024 - 12:00 a.m.

Essential Blocks for Gutenberg < 4.5.4 - Contributor+ Stored Cross-Site Scripting

2024-04-1200:00:00

wpscan.com

stored cross-site scripting

input sanitization

output escaping

authenticated attackers

contributor-level access

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

AI Score

5.9

Confidence

High

EPSS

Percentile

9.0%

JSON

Description The plugin is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

patchstack.com/database/vulnerability/essential-blocks/wordpress-essential-blocks-plugin-4-5-3-cross-site-scripting-xss-vulnerability