Stored Cross-Site Scripting in Essential Blocks for WordPress
CVE-2023-7071
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 January 2024
What is CVE-2023-7071?
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is susceptible to Stored Cross-Site Scripting. This vulnerability arises through the Table of Contents block due to inadequate input sanitization and output escaping in versions up to and including 4.4.6. As a result, authenticated attackers with contributor-level permissions can exploit this flaw to inject arbitrary web scripts into pages, leading to execution whenever a user visits those compromised pages.
Affected Version(s)
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates * <= 4.4.6