CVE-2024-3513

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 54.82%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dotcamp Ultimate Blocks Ultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks FOR Block Editor

Timeline

PublishedJul 2

Description

The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title tag (postTitleTag) parameter in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-6362 appears to be a duplicate of this iss…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NExploitability: 3.1 | Impact: 2.7

Affected Packages2 packages

▶NVDdotcamp/ultimate_blocks< 3.2.0

▶CVEListV5ultimateblocks/ultimate_blocks_–_25+_gutenberg_blocks_for_block_editor3.1.9

🔴Vulnerability Details

GHSA

GHSA-v7mv-85hf-9fxh: The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title tag parameter in all ver↗2024-07-02

▶

CVEList

Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attribute↗2024-07-02

▶