CVE-2024-4057

The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Configurations

Configuration 1 (hide)

cpe:2.3:a:kadencewp:gutenberg_blocks_with_ai:*:*:*:*:*:wordpress:*:*

History

21 May 2025, 19:10

Type Values Removed Values Added
First Time Kadencewp
Kadencewp gutenberg Blocks With Ai
References () https://wpscan.com/vulnerability/da4d4d87-07b3-4f7d-bcbd-d29968a30b4f/ - () https://wpscan.com/vulnerability/da4d4d87-07b3-4f7d-bcbd-d29968a30b4f/ - Exploit, Third Party Advisory
CWE CWE-79
CPE cpe:2.3:a:kadencewp:gutenberg_blocks_with_ai:*:*:*:*:*:wordpress:*:*

21 Nov 2024, 09:42

Type Values Removed Values Added
References () https://wpscan.com/vulnerability/da4d4d87-07b3-4f7d-bcbd-d29968a30b4f/ - () https://wpscan.com/vulnerability/da4d4d87-07b3-4f7d-bcbd-d29968a30b4f/ -

03 Jul 2024, 02:07

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.1

04 Jun 2024, 16:57

Type Values Removed Values Added
Summary
  • (es) El complemento Gutenberg Blocks with AI by Kadence WP WordPress anterior a 3.2.37 no valida ni escapa algunos de sus atributos de bloque antes de devolverlos a una página/publicación donde está incrustado el bloque, lo que podría permitir a los usuarios con el rol de colaborador y superiores realizar ataques de Cross-Site Scripting almacenado

04 Jun 2024, 06:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-06-04 06:15

Updated : 2025-05-21 19:10


NVD link : CVE-2024-4057

Mitre link : CVE-2024-4057

CVE.ORG link : CVE-2024-4057


JSON object : View

Products Affected

kadencewp

  • gutenberg_blocks_with_ai
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')