WordPress Ultimate Blocks <3.2.2 Contributor+ Stored XSS (CVE-2024-8536)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Plugin Name: Ultimate Blocks < 3.2.2 - Contributor+ Stored XSS 2. Description: The plugin does not properly validate or escape block attributes during output, allowing users with Contributor or higher roles to execute stored cross-site scripting (XSS) attacks. 3. Proof of Concept: Provides an example code snippet to trigger the XSS attack within a post. 4. Affected Plugin: , fixed in version 3.2.2. 5. Reference Link: https://research.cleantalk.org/cve-2024-8536/ 6. Classification: - Type: XSS - OWASP TOP 10: A7: Cross-Site Scripting (XSS) - CWE: CWE-79 - CVSS: 5.9 (Medium) 7. Additional Information: - Original Researcher: Dmitrii Ignatyev - Submitter: Dmitrii Ignatyev - Submitter Website: https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/ - Verified: Yes - WPVDB ID: abd5b6c6-f541-4739-882d-2011436f7a8b - Publication Date: 2024-09-09 - Added Date: 2024-09-09 - Last Updated Date: 2024-09-09 8. Other Vulnerabilities: - Google Analytics by Monster Insights < 7.2.0 - Authenticated Stored Cross-Site Scripting (XSS) - Enfold < 5.6.10 - Reflected Cross-Site Scripting - PowerPack Lite for Beaver Builder < 1.3.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting - Schema & Structured Data for WP & AMP < 1.27 - Authenticated Stored XSS - Simple Image Popup <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting This information provides a detailed description of the vulnerability, its scope of impact, security classification, and a list of related vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Ultimate Blocks <3.2.2 Contributor+ Stored XSS (CVE-2024-8536)

More from this source