CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31382 – WordPress Blocksy theme <= 2.0.22 - Cross Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2024-31382
Cross-Site Request Forgery (CSRF) vulnerability in Creative Themes HQ Blocksy.This issue affects Blocksy: from n/a through 2.0.22. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en Creative Themes HQ Blocksy. Este problema afecta a Blocksy: desde n/a hasta 2.0.22. The Blocksy theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.22. This is due to missing or incorrect nonce validation on the wp_ajax_blocksy_notice_button_click ajax action. • https://patchstack.com/database/vulnerability/blocksy/wordpress-blocksy-theme-2-0-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1767 – Blocksy <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-1767
The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping on user supplied attributes like 'className' and 'radius'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El tema Blocksy para WordPress es vulnerable a Cross-Site Scripting Almacenado a través de los bloques del complemento en todas las versiones hasta la 2.0.26 incluida, debido a una sanitización de entrada insuficiente y a un escape de salida en atributos proporcionados por el usuario como 'className' y 'radius'. Esto hace posible que atacantes autenticados con permisos de nivel de colaborador y superiores inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada. • https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=219324%40blocksy&new=219324%40blocksy&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/fdeab668-9094-485f-aa01-13ba5c10ea89?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-24871 – WordPress Blocksy Theme <= 2.0.19 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2024-24871
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy allows Stored XSS.This issue affects Blocksy: from n/a through 2.0.19. Neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('Cross-site Scripting') en Creative Themes Blocksy permite almacenar XSS. Este problema afecta a Blocksy: desde n/a hasta 2.0.19. The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via headers/footers in all versions up to, and including, 2.0.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/blocksy/wordpress-blocksy-theme-2-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •