CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 2CVE-2024-3239 – PostX < 4.0.2 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-3239
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks El complemento The Post Grid Gutenberg Blocks and WordPress Blog Plugin para WordPress anterior a 4.0.2 no valida ni escapa algunas de sus opciones de bloqueo antes de devolverlas a una página/publicación donde está incrustado el bloque, lo que podría permitir a los usuarios con el rol de colaborador y superior para realizar ataques de Cross-Site Scripting Almacenado The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied block attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://github.com/NN0b0dy/CVE-2024-32399 https://wpscan.com/vulnerability/dfa1421b-41b0-4b25-95ef-0843103e1f5e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2024-2509 – Gutenberg Blocks by Kadence Blocks < 3.2.26 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-2509
The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks El complemento Gutenberg Blocks by Kadence Blocks de WordPress anterior a 3.2.26 no valida ni escapa algunas de sus opciones de bloqueo antes de devolverlas a una página/publicación donde está incrustado el bloque, lo que podría permitir a los usuarios con el rol de colaborador y superior realiza ataques de Cross-Site Scripting Almacenado The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Form widget in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping on user supplied attributes such as 'placeholder'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://github.com/RandomRobbieBF/CVE-2024-25092 https://research.cleantalk.org/cve-2024-2509 https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 2CVE-2024-2369 – Page Builder Gutenberg Blocks < 3.1.7 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-2369
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks El complemento Page Builder Gutenberg Blocks de WordPress anterior a 3.1.7 no valida ni escapa algunas de sus opciones de bloqueo antes de devolverlas a una página/publicación donde está incrustado el bloque, lo que podría permitir a los usuarios con el rol de colaborador y superior realizar ataques de Cross-Site Scripting The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://github.com/0x20c/CVE-2024-23692-EXP https://wpscan.com/vulnerability/252dfc35-4c8c-4304-aa09-73dfe986b10d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •