CVE-2024-5221

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 57.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Qodeinteractive QI Blocks
Timeline
PublishedJun 6

Description

The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NExploitability: 3.1 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5qodeinteractive/qi_blocks1.2.9

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting↗2024-06-06
▶
GHSA
GHSA-53r7-4q94-9fmr: The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1↗2024-06-06
▶

💥Exploits & PoCs

1
Nuclei
Plone Docker - Host Header Injection
▶
CVE-2024-5221 (MEDIUM CVSS 5.4) | The Qi Blocks plugin for WordPress | cvebase.io