CVE-2024-1541 — Cross-site Scripting in Kadence Blocks Page Builder Toolkit FOR Gutenberg Editor

CWE-79 — Cross-site Scripting3 documents3 sources

Severity

5.4MEDIUMNVD

CNA6.4

EPSS

0.2%

top 54.43%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Stellarwp Kadence Blocks Page Builder Toolkit FOR Gutenberg Editor Kadencewp Gutenberg Blocks With AI

Timeline

PublishedMar 13

Description

The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmlTag attribute in all versions up to, and including, 3.2.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5stellarwp/kadence_blocks_page_builder_toolkit_for_gutenberg_editor3.2.23

▶NVDkadencewp/gutenberg_blocks_with_ai3.2.23

🔴Vulnerability Details

CVEList

Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting↗2024-03-13

▶

GHSA

GHSA-5qqm-68gx-7hgc: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmlTag attri↗2024-03-13

▶