Stored Cross-Site Scripting in VK Blocks for WordPress
CVE-2023-5706

5.4MEDIUM

Key Information:

Vendor: Wordpress
Status: VK Blocks
Vendor: CVE Published:; 22 November 2023

Summary

The VK Blocks plugin for WordPress contains a vulnerability that allows Stored Cross-Site Scripting (XSS) through the 'vk-blocks/ancestor-page-list' block. This occurs due to inadequate sanitization and escaping of user-supplied attributes, enabling authenticated attackers with contributor-level privileges to inject harmful web scripts into pages. These scripts will execute whenever a user visits a compromised page, creating significant risks for WordPress site security.

Affected Version(s)

VK Blocks * <= 1.63.0.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/vk-blocks/tags...

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Nov 22, 2023
Vulnerability Reserved
Oct 22, 2023

Credit

István Márton