The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/da4d4d87-07b3-4f7d-bcbd-d29968a30b4f/ | Exploit Third Party Advisory |
https://wpscan.com/vulnerability/da4d4d87-07b3-4f7d-bcbd-d29968a30b4f/ | Exploit Third Party Advisory |
Configurations
History
21 May 2025, 19:10
Type | Values Removed | Values Added |
---|---|---|
First Time |
Kadencewp
Kadencewp gutenberg Blocks With Ai |
|
References | () https://wpscan.com/vulnerability/da4d4d87-07b3-4f7d-bcbd-d29968a30b4f/ - Exploit, Third Party Advisory | |
CWE | CWE-79 | |
CPE | cpe:2.3:a:kadencewp:gutenberg_blocks_with_ai:*:*:*:*:*:wordpress:*:* |
21 Nov 2024, 09:42
Type | Values Removed | Values Added |
---|---|---|
References | () https://wpscan.com/vulnerability/da4d4d87-07b3-4f7d-bcbd-d29968a30b4f/ - |
03 Jul 2024, 02:07
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
04 Jun 2024, 16:57
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
04 Jun 2024, 06:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-06-04 06:15
Updated : 2025-05-21 19:10
NVD link : CVE-2024-4057
Mitre link : CVE-2024-4057
CVE.ORG link : CVE-2024-4057
JSON object : View
Products Affected
kadencewp
- gutenberg_blocks_with_ai
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')