The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
References
Link | Resource |
---|---|
https://research.cleantalk.org/cve-2024-2509/ | Third Party Advisory Exploit |
https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/ | Exploit Third Party Advisory |
https://research.cleantalk.org/cve-2024-2509/ | Third Party Advisory Exploit |
https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/ | Exploit Third Party Advisory |
Configurations
History
13 May 2025, 00:41
Type | Values Removed | Values Added |
---|---|---|
First Time |
Kadencewp
Kadencewp gutenberg Blocks With Ai |
|
CPE | cpe:2.3:a:kadencewp:gutenberg_blocks_with_ai:*:*:*:*:*:wordpress:*:* | |
CWE | CWE-79 | |
References | () https://research.cleantalk.org/cve-2024-2509/ - Third Party Advisory, Exploit | |
References | () https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/ - Exploit, Third Party Advisory |
21 Nov 2024, 09:09
Type | Values Removed | Values Added |
---|---|---|
References | () https://research.cleantalk.org/cve-2024-2509/ - | |
References | () https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/ - |
03 Jul 2024, 01:53
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
08 Apr 2024, 18:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Summary | (en) The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks |
05 Apr 2024, 12:40
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
05 Apr 2024, 05:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-04-05 05:15
Updated : 2025-05-13 00:41
NVD link : CVE-2024-2509
Mitre link : CVE-2024-2509
CVE.ORG link : CVE-2024-2509
JSON object : View
Products Affected
kadencewp
- gutenberg_blocks_with_ai
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')