Stored Cross-Site Scripting in Post Grid Combo Plugin for WordPress
CVE-2023-6645

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Vendor
CVE Published:
11 January 2024

Summary

The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping processes. This vulnerability affects all versions up to and including 2.2.64. Authenticated attackers with contributor access and higher can exploit this flaw to inject malicious web scripts into pages, which will subsequently execute when users visit those compromised pages, leading to potential data compromise and user session hijacking.

Affected Version(s)

Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks * <= 2.2.64

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafshanzani Suhada
.