Stored Cross-Site Scripting Vulnerability in Ultimate Blocks WordPress Plugin
CVE-2024-10678

Currently unrated

Key Information:

Vendor
Wordpress
Status
Ultimate Blocks
Vendor
CVE Published:
13 December 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

CVE-2024-10678 is a high-risk vulnerability found in Ultimate Blocks WordPress plugin versions prior to 3.2.4. This vulnerability occurs due to a failure in validating and escaping certain block options before rendering them on webpages. As a result, an attacker with a contributor role or higher could exploit this flaw to carry out stored cross-site scripting (XSS) attacks. This can lead to unauthorized access to sensitive user information and potentially site takeover. Website administrators utilizing this plugin are strongly advised to update to the latest version to mitigate any potential risks associated with this vulnerability.

Affected Version(s)

Ultimate Blocks 0 < 3.2.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10678 - Proof of Concept

References

https://wpscan.com/vulnerability/9342c6a1-4f9a-45f3-911d-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
WPScan
.