Stored Cross-Site Scripting in VK Blocks for WordPress

CVE-2023-5706

What is CVE-2023-5706?

The VK Blocks plugin for WordPress contains a vulnerability that allows Stored Cross-Site Scripting (XSS) through the 'vk-blocks/ancestor-page-list' block. This occurs due to inadequate sanitization and escaping of user-supplied attributes, enabling authenticated attackers with contributor-level privileges to inject harmful web scripts into pages. These scripts will execute whenever a user visits a compromised page, creating significant risks for WordPress site security.

References